Security

Your documents stay private

Uploaded files are stored privately in a bucket that is never publicly listable or browsable, and file names are randomised so a document can’t be guessed at. A file is served in exactly two situations: to your own signed-in account, or through a share link you created and explicitly switched file downloads on for. Share links are status-only by default— they show whether a document is valid, expiring or expired, and nothing else. Downloads are off until you turn them on, apply only to the one link you enabled, and stop working the moment you revoke it.

Encryption

• All traffic is encrypted in transit over HTTPS (TLS), enforced with HSTS.
• Your uploaded documents are encrypted at rest with AES-256 by Cloudflare R2, where the files are stored. Your account data is encrypted at rest with AES-256 by Neon, our database provider. In both cases the encryption is managed by the provider and applied automatically to everything stored.
• Passwords are hashed with bcrypt — we never store or can see your actual password.
• Two-factor authentication secrets are encrypted at rest, so they stay protected even in a backup.

Accounts & access

• Optional two-factor authentication (authenticator app) adds a second step at login, with one-time backup codes.
• Sessions use secure, http-only cookies that JavaScript can’t read.
• Changing your password immediately signs out every other device.
• Login, signup and password-reset are rate-limited to block automated guessing.

Payments

Subscriptions are handled entirely by Stripe, a PCI-certified payment provider. Card details go straight to Stripe — CompliCloud never sees or stores your card number.

Backups & reliability

Your data is backed up automatically every day so nothing is lost to a hardware failure. Backups deliberately exclude sensitive secrets such as password hashes and two-factor keys. The service is monitored around the clock, and errors are tracked so we can fix issues fast.

The application itself

Every page is served with a strict set of security headers — a Content-Security-Policy, protection against clickjacking and MIME-sniffing, and a strict referrer policy — to shut down whole classes of web attacks before they start.

Your data is yours

• Export everything you’ve added at any time (CSV and a printable audit pack).
• Delete any document — or your whole account — whenever you like.
• We never sell your data, and we don’t run ad trackers.

Found something?

If you believe you’ve found a security issue, please email info@compli-cloud.com — we take reports seriously and will get back to you quickly.