Security you can check.Not just read about.
A privacy platform holds some of your most sensitive work. This page shows how ComplyZero protects it, in the detail your IT team will ask for, and the parts you can verify for yourself.
Built by data protection lawyers and cybersecurity experts.
Every export is signed. Anyone can check it.
Saying consent was collected is easy. Proving the record was never touched afterwards is the hard part. Every consent evidence export from ComplyZero is signed by us and carries a fingerprint for every file and every record inside it.
- Our public signing keys are published, so anyone can confirm a package came from ComplyZero.
- Whoever you hand an export to can check it with Seal Check, free, or have their own team run the verifier. Either way the signature, every file and every record are re-checked, so they don't have to take your word for it.
- Change, remove or slip in a single record and the check fails.
How it works
Packages are signed with Ed25519. Each record carries a SHA-256 fingerprint of its stored facts, and the signed manifest lists the SHA-256 and size of every file. The verifier is one script that needs nothing but Node.js 20.
$ node verify-evidence-package.mjs consent-export-7KQ2.zipComplyZero evidence package verifier, version 1Package: consent-export-7KQ2.zipPackage SHA-256: 9f2c41d07be3…a85e41a.Signature: verified (key evidence-1).Layout and files: 8 of 8 match.Records: 4,812 verified, 0 failed.Versions: 7 cited, 7 match.Result: verified.
Your records stay yours. Enforced by the database.
ComplyZero is one platform with many customers. Your records are walled off from everyone else's at three separate layers, so a slip in one is stopped by the next.
In the application.
Every request checks who is asking, which organisation they belong to and whether their role allows that action on that record.
In the database.
Row-level security on customer tables means the database itself hands back only your organisation's rows, whatever the application asks for.
In the database roles.
Each part of ComplyZero (the API, background jobs, public forms and support tools) connects with its own restricted role. None of them can switch row-level security off.
Can your team see our data? Only in three ways.
Day to day, nobody at ComplyZero needs to look inside your account. When someone does, it happens one of three ways, and each one is recorded.
- Support, when you allow it. Your Organisation owner picks a named support specialist on the Help page and allows access for 24 hours, and can end it at any time. The specialist cannot change anyone's sign-in details, accept agreements for you or let anyone else in.
- Raw Discovery previews, with their own permission. For our staff, the original text behind a finding needs separate customer authorisation, for one resource and a limited time.
- Administrators, to fix what cannot wait. Named ComplyZero administrators can enter an account directly to resolve a problem. Each entry is recorded, along with every action taken during it.
Every file opens in quarantine. Masked by default.
Discovery reads the documents you point it at, from PDFs and spreadsheets to slides and scanned images, and , India's most advanced PII detection engine, finds the personal data in them. Each one is opened in a throwaway process with no internet access, no view of the rest of the system and hard limits on memory and time. A file built to cause harm has nowhere to go.
Reviewers see masked findings by default: the kind of personal data, where it was found, and an example such as a••••@example.com.
How it works
Parsing runs as a non-root process locked down by the Linux kernel's seccomp and Landlock controls, with outbound networking switched off. Each job gets its own size-capped scratch space, and a job that makes no progress for 60 seconds is stopped. If those protections are not in place, the worker refuses to take work.
Encrypted before it is stored.
Private files, the credentials that connect ComplyZero to your systems and single sign-on secrets are encrypted on our servers before they are stored, with AES-256-GCM. Every file gets its own key, bound to the organisation and resource it belongs to, so a copy used anywhere else is caught.
- Separate keys for separate data. Request files, incident files, Discovery files and connector credentials each sit under their own master key. More than twenty in all.
- Keys that can change. Every master key is versioned. A new version takes over for new data while older data stays readable, with no downtime.
- Kept apart. Master keys are never stored in the database or next to the files they protect.
- Secrets kept as fingerprints. API keys and the codes people use to verify a data request are stored as keyed fingerprints, never as the secret itself.
Every sensitive action has an actor and a time.
Governed actions are recorded with who did them, when and under which permission. Consent records are written once: the application cannot edit or delete them, and every deletion under a retention rule is logged. Consent evidence keeps the exact notice wording it referenced, even after the notice changes.
Your records live in India.
The database that holds your records, and the keys that protect your files, are in India. Private files are encrypted in India before they are stored, so our storage provider only ever holds encrypted data.
A few services run beyond that. Emails go out through email delivery providers, parts of our website and the banner script are served through a content delivery network, and support chat runs on a chat provider. Ask us for the full list of providers and where each one processes data.
The essentials, done properly.
Single sign-on with your identity provider on the Enterprise tier. Your roles still decide what each person can do.
Roles and permissions keep sensitive actions with the right people, checked on every action, not just at sign-in.
API keys with scope, expiry, revocation and IP restrictions.
Sign-in limits. Repeated sign-in, code and sign-up attempts are rate limited.
Expiring downloads. A person collecting their data request response confirms a one-time code, and the download link lasts five minutes.
Read-only connections. Database connectors open read-only sessions, with a five-second limit on every query.
If something goes wrong, you hear from us.
Report a security concern to security@complyzero.com. We acknowledge reports and keep you informed while we investigate. Customers are notified of incidents that affect their data without undue delay, with more detail as we learn it.
Reviewing us for procurement?
We will send our data processing agreement, the list of providers and where each one processes data, and straight answers to your security questionnaire.
Ask for the review packAsk us the hard questions.
Bring your questionnaire, your IT team or your toughest reviewer. We would rather be precise than reassuring.