Security

ComplianceDesk runs entirely on Cloudflare's global network — no traditional servers to patch or lose track of. This page describes the real controls behind the product you're using to manage your own compliance.

1. Infrastructure

The application and database run on Cloudflare Workers and Cloudflare D1. Evidence files and other uploads are stored in Cloudflare R2, isolated from the database backups below. All traffic is served over HTTPS/TLS; data at rest in D1 and R2 is encrypted by the underlying Cloudflare platform.

2. Tenant isolation

Every request is checked against the requesting user's organisation membership before any tenant-scoped data is read or written, enforced at the application layer on every code path that serves data. One organisation's members cannot reach another organisation's data through the Service.

3. Backups and recovery

The production database is backed up automatically once a day, with each backup retained for 90 days in a dedicated storage bucket separate from your uploaded evidence. The database platform itself also keeps a 30-day point-in-time recovery window on top of those daily backups.

4. Authentication

Passwords are hashed, never stored in plain text. Optional two-factor authentication (TOTP, compatible with any standard authenticator app) is available on every account, with one-time recovery codes issued when you enable it. Repeated failed sign-in attempts temporarily lock an account to resist password-guessing.

5. Audit logging

Actions taken in your organisation — control status changes, evidence uploads, member and permission changes, billing events — are written to an audit log you can review and export at any time, giving you (and your own auditor) an independent record, not just our word for what happened.

6. Status and uptime

Live uptime monitoring for the Service is public at status.compliance-desk.com.

7. Sub-processors

See the Privacy Policy's sub-processors section for the current list of third parties involved in running the Service.

8. Reporting a security issue

If you believe you've found a security vulnerability, email legal@compliance-desk.com with details. We ask that you give us a reasonable opportunity to investigate and address a report before any public disclosure.

9. What we don't yet have

ComplianceDesk is an actively developing platform and does not currently hold a formal third-party security certification (such as a SOC 2 report) of its own. If a specific attestation matters for your procurement process, email legal@compliance-desk.com and we'll tell you plainly where things stand.