Security
You are about to put your regulatory exposure in our database. Here is exactly how it is protected — and what we have not done yet.
Your data lives on servers in the EU. There is no US region, no replication outside the EU, and no third-party processor holding a copy of your compliance record. For an EU AI Act tool that is not a marketing line — the record of your regulatory exposure should not leave the jurisdiction that regulates you.
All traffic is HTTPS, with certificates issued and rotated automatically by Let's Encrypt. HSTS is enabled with a one-year max-age, includeSubDomains and preload, so a browser will refuse to talk to us over plain HTTP even on a first visit.
Postgres publishes no host port. It is reachable only from the application container over a private bridge network — there is no address on the public internet where the database answers, so it cannot be scanned, brute-forced or reached at all from outside.
Passwords are hashed with argon2id — the memory-hard algorithm recommended by OWASP — never stored or logged in plaintext, and never recoverable by us. Login attempts are rate-limited per client IP, with the client address taken from a proxy header the edge rewrites so it cannot be spoofed.
A strict Content-Security-Policy, X-Frame-Options: DENY (we cannot be framed or clickjacked), and X-Content-Type-Options: nosniff. File uploads are checked by magic bytes rather than trusting the declared type, and CSV exports are escaped against spreadsheet formula injection.
The database is dumped every night and kept for fourteen days. The backup job fails loudly rather than quietly: if a dump errors, the partial file is deleted instead of being left behind to look like a valid backup.
Actions in your workspace are written to an append-only audit log with actor, action, entity and timestamp — the same record an auditor will ask you for. Evidence files are versioned and superseded rather than overwritten, so history cannot be quietly rewritten.
A security page that only lists strengths tells you nothing, because no vendor has ever written one that did otherwise. Here is the other half — the things a careful buyer should know we are missing.
- No SOC 2 report
- We have not completed a SOC 2 Type I or Type II examination and hold no SOC 2 report. If your procurement process requires one, we cannot satisfy it today — ask us for the control detail instead and we will answer in writing.
- No ISO 27001 certificate
- We are not certified to ISO/IEC 27001, and we do not display a badge for it. Our internal controls are modelled on it — that is not the same thing as an accredited certification, and we will not imply that it is.
- No external penetration test yet
- The application has not been tested by an independent third-party security firm. The hardening described above is our own work, verified against the running system; it has not been adversarially reviewed by someone with no stake in the answer.
- Support is business hours, not 24/7
- Security reports are read during European business hours and acknowledged within two business days. There is no on-call rotation and no round-the-clock security desk. A weekend report will be picked up on the next working day.
We will move items out of this list when they are actually done — not when they are planned.
If you find a security issue, email support@getconformly.com with the details and how to reproduce it. We will acknowledge within two business days and we will not take legal action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it before going public.
Processing details, your rights and our sub-processors are in the Privacy Policy. Payments and card data are handled entirely by our merchant of record and never reach our servers — see Terms.