Security is not a feature bolted onto ComplyBar—it's baked into the core architecture. Accounting data is sensitive and regulated. Every team deserves a platform built from the ground up to protect that trust, without paying enterprise pricing for it.

Infrastructure

ComplyBar runs on industry-standard, SOC 2 Type II–certified infrastructure. Your data lives on:

Vercel for application hosting, with globally distributed edge nodes, automatic HTTPS, and DDoS protection
Supabase (PostgreSQL on AWS) for the database, with encryption at rest, daily automated backups, and point-in-time recovery

Both providers maintain SOC 2 Type II compliance and are independently audited. You can review their security certifications directly.

Data Encryption

Your data is encrypted at every stage:

In transit: All communication uses TLS 1.2 or higher. ComplyBar enforces HTTPS everywhere; unencrypted HTTP is not allowed.
At rest: Database encryption is managed by Supabase using AES-256. You do not manage encryption keys yourself; Supabase handles key rotation and compliance.

Access Control

ComplyBar enforces role-based access control at the database layer, using PostgreSQL Row Level Security (RLS). This means:

Each organization is completely isolated from others. No query can accidentally leak data across tenant boundaries.
Within your organization, permissions are role-based. Four roles control what each team member can see and do:
- Admin: Full control over the organization, team members, and settings
- Manager: Can create and assign tasks, close periods, and manage most workflows
- Member: Can work on assigned tasks, upload evidence, and view the close schedule
- Viewer: Read-only access to tasks and reports; cannot make changes
Role permissions are enforced at the database layer, not just in the application. A member cannot escalate their own permissions by bypassing the UI.

Authentication

Account security is handled through:

Supabase Auth for user account management, including password reset, email verification, and session management
Bcrypt for password hashing, with adaptive work factors that resist brute-force attacks
SAML 2.0 single sign-on (SSO) for enterprise teams, allowing you to leverage your existing identity provider

Incident Response

If we discover a security incident that affects your data, we will notify you within 72 hours with details about what happened, what we've done to remediate, and what you should do next.

We maintain a public status page at status.complybar.com where you can check the health of ComplyBar and subscribe to updates.

Vulnerability Disclosure

If you discover a security vulnerability, please report it responsibly to security@complybar.com. We ask that you:

Provide a clear description of the vulnerability and steps to reproduce (if applicable)
Give us at least 2 business days to acknowledge and begin investigating before public disclosure
Work with us to develop and test a fix before the vulnerability becomes public
Allow time for our users to update before you publish details of the vulnerability

We take security reports seriously and will keep you informed throughout the process. Thank you for helping us keep ComplyBar safe.

SOC 2 Roadmap

ComplyBar is working toward SOC 2 Type II compliance. Our underlying infrastructure (Vercel and Supabase) is already SOC 2 Type II–certified. As we scale, we will pursue formal SOC 2 Type II attestation for the full platform, including application-layer controls.

We believe in honesty about where we are. ComplyBar is built on secure foundations, but we are a young company and will continue to strengthen our security practices and audit readiness.

Questions?

For security questions or concerns, reach out to security@complybar.com.