Security
You trust us with your compliance evidence. This page explains how we protect it. Questions: security@complibox.app.
Where your data lives
- Uploaded documents and evidence are stored on Amazon Web Services in the Mumbai (ap-south-1) region.
- [verify: database and application server location]
Access control
- Separate organisations. Every request is checked against the organisation you belong to, so one customer can't see another's data.
- Role-based access. Organisation Admins, team roles and a read-only Auditor role each see only what they need.
- Verified sign-ups. New accounts stay inactive until the owner confirms a one-time code sent to their email.
- Password rules. Common passwords, very short ones and ones similar to your name or email are rejected. Passwords are stored only as one-way hashes.
- Rate limiting. Sign-up, verification and public endpoints are throttled to slow down abuse.
Tamper-evident audit trail
Every create, update and delete of compliance records is logged with who did it, when, from which IP address, and what changed. Each entry is linked to the previous one with a SHA-256 hash, so any change to history is detectable. The database itself blocks edits and deletions of audit entries, and the whole chain can be re-checked at any time [verify: daily integrity check is scheduled in production].
Consent records and published privacy notices are kept the same way: they can be added to but never rewritten.
Encryption
- [verify: TLS version enforced for all traffic to the website and app]
- [verify: encryption at rest for the database and S3 storage]
Operations
- Secrets such as keys and passwords are kept out of the code and loaded from the environment.
- We use error monitoring to find and fix problems quickly.
- [verify: backup frequency, retention and restore testing]
- [verify: incident response process and how customers are notified of a breach]
Certifications
[verify: current status. Do not claim SOC 2 or ISO 27001 certification until it is achieved.]
Reporting a vulnerability
If you think you've found a security issue, email security@complibox.app with the details. Please give us reasonable time to fix it before disclosing it publicly, and don't access or change other customers' data while testing. We'll acknowledge your report within [verify: 3] working days.