Security and trust

Here is where PHI stops.

COMPLI3D processes conversion data under a business associate agreement and removes identifiers before anything reaches an ad network. This page lists how, and what we have not yet confirmed in writing.

Request the BAA Read the agreement

HIPAA · 42 CFR Part 2 · BAA available

Data flow

Three zones, one boundary.

PHI may be present

Visitor's browser

Pages, forms and calls on your site. The gateway holds every script until opt-in.

Processed under BAA

COMPLI3D servers

Identifiers removed, opaque code assigned, full record kept for your dashboard. [VERIFY REGION]

No PHI sent

Ad networks

Click ID, opaque code and time. Nothing else.

Business associate agreement

We sign before data flows.

A business associate agreement is available to every customer. [VERIFY PLAN SCOPE] It covers Consent Gateway and Conversion Relay, and will cover First-Party Analytics when it is available.

Read the agreement

What it covers

Permitted uses of PHI processed by COMPLI3D
Safeguards we maintain
Breach notification to you [VERIFY TIMEFRAME]
Subprocessors bound to the same terms
Return or deletion of data at the end of the contract

Request the BAA

Controls

Hosting, encryption, retention, access.

Values in brackets are being confirmed and will be published as written policy.

Hosting

Provider: [PROVIDER]
Region: [REGION]
Provider BAA: [VERIFY]

Encryption

In transit: [TLS VERSION]
At rest: [STANDARD]
Key management: [VERIFY]

Retention

Conversion records: You set it · default [DAYS]
Delivery log: [DAYS]
Consent log: [DAYS]

Access controls

Customer roles: Admin, editor, viewer [VERIFY]
Sign-in: MFA, SSO on Network plans [VERIFY]
Staff access: Least privilege, audit logged [VERIFY]

Subprocessors

Who else touches the data.

Subprocessors, their purpose, location and whether a business associate agreement is in place
Subprocessor	Purpose	Location	BAA in place
[NAME]	Cloud hosting	[REGION]	[VERIFY]
[NAME]	Transactional email	[REGION]	[VERIFY]
[NAME]	Error monitoring	[REGION]	[VERIFY]

The current list lives at /legal/subprocessors. Customers are notified before a new subprocessor is added. [VERIFY NOTICE PERIOD]

Responsible disclosure

Found a vulnerability? Tell us.

We investigate every report and credit researchers who ask to be credited.

Report to: [SECURITY EMAIL]
Acknowledgement: Within [DAYS] business days
security.txt: compli3d.ai/.well-known/security.txt [VERIFY]

Please do not access data that is not yours, degrade the service, or test against customer sites.

Certifications and audits

[BADGE · only once earned]
[BADGE · only once earned]
[BADGE · only once earned]
[BADGE · only once earned]

We show a certification or audit only after it is complete. None are claimed today.

Business associate agreement

Request the BAA for your review.

We'll send the agreement and answer your security questionnaire.

Request the BAA Book a demo