Security - CompliTraceAI

UK-Hosted Infrastructure

All CompliTraceAI data is hosted exclusively in the United Kingdom using Amazon Web Services (AWS) in the eu-west-2 (London) region. Your data never leaves UK jurisdiction. This ensures compliance with UK data protection regulations and provides the lowest latency for UK-based customers.

Encryption

🔐

Encryption at Rest

All data stored on our servers is encrypted using AES-256 encryption. Database backups are also encrypted with separate keys managed through AWS KMS.

🌐

Encryption in Transit

All communications between your browser and our servers are encrypted using TLS 1.3. API endpoints enforce HTTPS-only access.

🔑

Key Management

Encryption keys are rotated regularly and stored in hardware security modules (HSMs) through AWS KMS with strict access controls.

GDPR Compliance

CompliTraceAI is fully compliant with the UK General Data Protection Regulation (UK GDPR) and the Data Protection Act 2018. Key measures include:

✅ Data Processing Agreement — Standard contractual clauses in place with all sub-processors
✅ Data Protection Officer — Named DPO available at dpo@complitraceai.com
✅ Data Subject Rights — Full support for access, rectification, erasure, portability, and objection requests
✅ Breach Notification — 72-hour notification commitment in accordance with GDPR requirements
✅ Data Retention — Automated data lifecycle management with configurable retention policies
✅ International Transfers — No data leaves the UK. All infrastructure is AWS London (eu-west-2)

Security Roadmap

SOC 2 Type II

SOC 2 compliance audit is in progress. Expected completion: Q3 2026. We are implementing controls across security, availability, and confidentiality trust principles.

Penetration Testing

Quarterly third-party penetration tests are conducted. The most recent test was completed with no critical findings. Full reports are available to Enterprise customers.

ISO 27001

ISO 27001 certification is on our roadmap for 2027, building on our SOC 2 foundation.

Responsible Disclosure

If you discover a security vulnerability in CompliTraceAI, we encourage you to report it responsibly. We will acknowledge receipt within 24 hours and aim to resolve critical issues within 48 hours.

Please email: security@complitraceai.com

We do not currently operate a bug bounty program but will acknowledge and credit researchers in our security changelog.