Where is ComplyPilot data stored?
ComplyPilot runs on infrastructure hosted in the European Union. Your risks, controls, evidence files, policies and audit logs are stored in the EU. ComplyPilot is operated from Belgium and is built for organisations subject to EU law, including the GDPR.
How is customer data separated?
ComplyPilot is multi-tenant: each customer organisation has its own workspace. Isolation is enforced in the database with row-level security policies, so every query is restricted to organisations the signed-in user belongs to. Application code additionally filters by organisation. Evidence files are stored in organisation-scoped storage and are downloaded through short-lived signed links.
How are accounts protected?
- Passwords need at least 8 characters with upper-case, lower-case, number and special character.
- New passwords are checked against known data breaches using the Have I Been Pwned k-anonymity service, so the password itself is never sent.
- Optional multi-factor authentication with an authenticator app (TOTP) and one-time recovery codes.
- Role-based access inside each organisation, including read-only roles.
- Automatic session timeout for inactive sessions.
How are changes tracked?
Create, update and delete actions on compliance records are written to an audit log. Audit-log entries cannot be edited or deleted by users, which gives your auditor a trustworthy history of who changed what and when.
How is data backed up and encrypted?
- Data is encrypted in transit with TLS and encrypted at rest by the hosting platform.
- Automated weekly database backups with eight weeks of retention.
- Rate limiting and input validation on server functions.
- Regular automated security scanning of the application and its dependencies.
How does ComplyPilot use AI?
ComplyPilot's AI advisors answer questions using your organisation's own records. Requests run with the signed-in user's permissions, so an advisor can only see data that user is allowed to see. AI features are optional and can be limited per plan.
Can I export or delete my data?
Yes. Organisation admins can export the core modules as CSV or a ZIP bundle at any time. Deleting an organisation uses a two-step confirmation and removes the organisation's data.
How do I report a security issue?
Send security reports or questions to info@comply-pilot.com. Please include steps to reproduce and do not access other customers' data.
Frequently asked questions
Is ComplyPilot hosted in the EU?
Yes. ComplyPilot is hosted in the European Union and operated from Belgium.
Can other customers see my data?
No. Each organisation is isolated with database row-level security, and files are only reachable through short-lived signed links.
Does ComplyPilot support multi-factor authentication?
Yes. Users can enable authenticator-app (TOTP) multi-factor authentication with recovery codes.