Security is in our DNA

Data is encrypted at rest and in transit.

• Encrypted at rest: database volumes (Fly.io) and evidence storage (Cloudflare R2, AES-256)
• TLS for all data in transit — complicer.com negotiates TLS 1.3
• Evidence artifacts additionally encrypted at the application layer
• Signing and encryption keys held as access-controlled platform secrets — never in code or images

Application, database, and evidence storage run in the European Union.

• Application and PostgreSQL on Fly.io in Frankfurt, Germany (fra); evidence in Cloudflare R2 under EU jurisdiction
• Supporting services with US data flows are named — with exactly what each receives — on our procurement page
• Cloudflare network-level DDoS protection and WAF in front of the application
• Hosting provider (Fly.io) maintains its own compliance posture for the layers it operates

Granular access controls ensure only authorized users can access your data.

• Role-based access control (RBAC) for all accounts
• Multi-factor authentication (MFA) support
• SSO integration (Azure AD, Okta) for Enterprise
• Session management with automatic timeout

We hold ourselves to the same compliance standards we help you achieve.

• GDPR-aligned data processing
• Tamper-evident evidence: SHA-256 hash-chained + Ed25519-signed
• No SOC 2 / ISO 27001 yet — we will not claim a control we have not been awarded
• Article 28 DPA drafted and in legal review — see our procurement page

Automated failure detection with honest notification commitments.

• Synthetic scan canary every 6 hours, dead-letter alerting, and error monitoring
• Documented operational runbook and per-incident root-cause records
• Personal-data breach notification without undue delay (GDPR Art. 33)
• Root-cause review after every incident

Recurring adversarial review of the codebase and its controls.

• Internal security sweeps across tenant isolation, authorization, and abuse paths — findings tracked to closure
• Independent cross-model adversarial reviews on security-relevant changes
• No accredited third-party penetration test yet — planned; we will not claim one until it has happened

Snapshot-based recovery with honestly stated limits.

• Automated daily database volume snapshots with 5-day retention (Fly.io)
• Volumes encrypted; evidence stored separately in Cloudflare R2 (EU) with SHA-256 checksums
• Recovery is snapshot-based — recovery point up to 24 hours; we do not claim point-in-time recovery

We welcome security researchers and maintain a responsible disclosure program.

• Dedicated security contact: [email protected]
• Prompt acknowledgment — typically within one business day
• Safe harbor for good-faith security research
• Credit to verified reporters on request