Security
Compliance starts with us.
Last updated: 27 May 2026
Infrastructure & Hosting
Comeply's platform is hosted on cloud infrastructure located within the European Union. We operate within a dedicated environment that provides logical isolation between customer data. Infrastructure is managed by a cloud provider subject to ISO 27001 and SOC 2 certification. Specific provider details are available upon request under NDA for enterprise customers undergoing security due diligence.
Data Encryption
All data transmitted between your browser and the Comeply platform is encrypted in transit using TLS 1.2 or higher. All customer data stored on our infrastructure is encrypted at rest using AES-256 encryption. Encryption keys are managed and rotated on a regular schedule.
Access Controls
Access to the Comeply platform is protected by role-based access controls. Each user account is scoped to the permissions assigned by your organisation's administrator. We support multi-factor authentication and recommend it for all users. Internal Comeply staff access to customer data is restricted on a strict need-to-know basis and is logged for audit purposes.
Data Isolation
Customer data is logically isolated within our infrastructure. No customer can access another customer's data. Comeply employees access customer data only where required to deliver support and only with appropriate authorisation.
Subprocessors
Comeply uses a limited number of trusted subprocessors to operate the platform. These include our EU-based cloud infrastructure provider, PostHog (for website analytics on our marketing website only, not on the platform itself), and any communication tooling used for customer support. All subprocessors are subject to data processing agreements and are required to maintain appropriate security standards. A full list of subprocessors is available upon request.
Website Analytics
Our marketing website runs analytics in cookieless mode. Nothing is stored on your device, session recording is switched off, and no third-party tracking bundles are loaded. That is why this site asks you to accept nothing when you arrive. The platform itself carries no marketing analytics at all.
Vulnerability Management
We conduct regular internal reviews of our codebase and infrastructure for security vulnerabilities. We maintain a responsible disclosure policy. If you believe you have identified a security vulnerability in Comeply, please report it to security@comeply.com and we will investigate and respond within 5 business days. We ask that you do not publicly disclose any potential vulnerability until we have had the opportunity to investigate.
Incident Response
Comeply maintains an internal incident response process. In the event of a confirmed security incident affecting customer data, we will notify affected customers within 72 hours of becoming aware of the breach, in accordance with our obligations under GDPR. Notifications will include the nature of the incident, data affected, and steps we are taking to address it.
AI Governance
Comeply's AI features are developed in alignment with emerging AI-assurance frameworks, including ISO/IEC 42001 (AI management systems) and the EU AI Act. Our approach emphasises explainable, traceable outputs under human review. Every AI-generated insight links back to its source guidance, and validated outputs record the changes and evidence behind them. Comeply does not train AI models on customer documents or data. Formal certification against ISO/IEC 42001 is part of our roadmap; we are glad to discuss our current AI governance posture with enterprise customers under NDA.
Data Protection & Certifications
Comeply operates in accordance with GDPR requirements applicable to a data processor and controller. We are working toward formal ISO 27001 certification. Enterprise customers requiring evidence of our security posture for vendor qualification or audit purposes are invited to contact us directly to discuss what documentation we are able to provide.
For all security-related enquiries, responsible disclosure, or vendor security questionnaires:
contact@comeply.com · Comeply ApS · CVR 45448959
