Security

Compliance HQ helps teams review documents against their own policies using AI, with mandatory human sign-off. We treat the security and isolation of customer data as foundational. This overview summarizes our current practices and what’s on our near-term roadmap.

Last updated: July 2026

Data protection

All traffic is encrypted in transit with TLS 1.2+ (HTTPS) across the application and API.

Data is stored in a managed PostgreSQL database (Neon) with encryption at rest.

User passwords are hashed with bcrypt (salted, one-way) — never stored in plaintext.

API keys and connection strings are stored as platform secrets, never in source code. Our source repository is private.

Tenant isolation

Every organization’s data is scoped to that organization. The policy/vector store enforces isolation at the database level via PostgreSQL Row-Level Security (FORCE RLS).

All other customer data is scoped by organization on every request.

Role-based access (admin / member) with invite-only organization membership.

AI processing & sub-processors

Document text is processed by OpenAI’s API (GPT-4o and embeddings) to generate review findings.

OpenAI does not use data submitted via its API to train its models, per OpenAI’s API data-usage policy.

Document content is sent to OpenAI only transiently for processing; it is never used to train Compliance HQ or any third-party model.

Human oversight & recordkeeping

Every review requires a human reviewer to approve or reject before a decision is final — the AI never decides autonomously.

Each review’s decision, reviewer, notes, and timestamps are persisted for recordkeeping.

Infrastructure & availability

Hosted on managed platforms: Neon (database), Render (backend), and Vercel (frontend).

Automated database backups are provided by our database platform.

Continuous integration and delivery via GitHub Actions.

Roadmap

Planned

The following are planned and will be addressed in the near future. They are not yet in place today.

SOC 2 Type IIIndependent audit of our security controls and processes.

Third-party penetration testingRegular external security testing of the application and infrastructure.

SSO / SAML & MFAEnterprise single sign-on and multi-factor authentication.

Tamper-evident audit loggingDedicated, immutable audit trail of security-relevant events.

HIPAA compliance & BAABusiness Associate Agreements to support workloads involving protected health information.

Data Processing Agreement (DPA)Standardized DPA covering processing, retention, and sub-processors.

This document describes current practices and near-term plans for evaluation purposes and is not a contractual commitment. For security questions or due-diligence requests, contact security@compliancehq.ai.