Your Data Security is Our Priority
Commercial real estate financing involves sensitive financial data. We've built Comply with bank-level security to protect your most valuable information.
Comprehensive Security Features
Every layer of our platform is designed with security in mind
End-to-End Encryption
TLS 1.2+ in transit and AES-256 at rest. Your pay applications, waivers and reports are encrypted at every step.
SOC 2 Type II (In Progress)
Our SOC 2 Type II audit is underway. The controls it tests, audit logging on every action, role-based permissions, encryption and access reviews, are already in production.
Multi-Factor Authentication
Protect your account with two-factor authentication from an authenticator app, or sign in with Google or Microsoft.
Role-Based Access Control
Granular permissions ensure team members only access what they need. Audit logs track every action for complete accountability.
Enterprise Cloud Infrastructure
Hosted on US-based, AWS-backed cloud infrastructure with encrypted storage and automated backups. US-hosted only.
Secure Document Storage
Documents are stored encrypted with per-deal access control, version history on every checklist item, and an audit trail of who uploaded, viewed and changed what.
Compliance Status
Our SOC 2 Type II audit is in progress. We publish status here rather than claims: what is in production today, what is under audit, and what is aligned to regulation. The program is built to the standards construction lenders and their consultants are held to.
SOC 2 Type II
GDPR
CCPA
Vulnerability Management
Automated dependency and vulnerability scanning, with security review as part of the SOC 2 audit program.
Regulatory Compliance
Built to meet the requirements of financial regulators and lending institutions.
Continuous Monitoring
Every action is written to the audit log, security events are recorded, and removing a super admin needs dual authorization.
SOC 2 Trust Service Criteria
The audit covers all five Trust Service Criteria. Here is how COMPLY addresses each one today.
Security
Protection against unauthorized access. Role-based permissions down to the sub-permission, two-factor authentication, and edit locks so two people cannot overwrite each other.
Availability
Systems are available for operation and use as committed. Managed, redundant cloud infrastructure, automated backups and a public status page.
Processing Integrity
System processing is complete, valid, accurate, timely, and authorized. All transactions are logged and auditable.
Confidentiality
Information designated as confidential is protected as committed. Data is encrypted and access is strictly controlled.
Privacy
Personal information is collected, used, retained, disclosed, and disposed of in conformity with our privacy notice.
SOC 2 Type II audit status
The audit is underway. When the report is issued we will make it available to customers, prospects and partners under NDA, and this page will say so. Until then we are glad to walk through our controls or complete your vendor security questionnaire.
Questions About Security?
Our security team is available to discuss our practices, provide documentation, or complete your vendor security questionnaire.