Privacy Policy

This policy covers the personal data ComplyHub processes when you or your organization use the Service. It doesn't cover the compliance content you choose to enter (policies, controls, evidence, risk records) — that's your organization's data, handled under the Terms of Service.

• Account data: name, email address, organization membership and role.
• Content you provide: anything entered into frameworks, requirements, controls, evidence, policies, the risk register, vendor records or uploaded files.
• Usage and log data: sign-in activity and the write-once audit trail recorded for every material action in the app — this is a compliance feature, retained deliberately.

To provide the Service (authenticate you, scope data to your organization, generate reports, send the notifications you or your admin have enabled), to secure it (virus-scan uploads, detect misuse), and to support you when you contact us. We don't sell personal data, and we don't use your organization's compliance content to train models or for any purpose beyond providing the Service to you.

The infrastructure the Service runs on:

Applied consistently across every organization:

Each organization's data is isolated at the database level via row-level security, not application logic alone. Uploads are virus-scanned before storage. Multi-factor authentication and, on eligible plans, single sign-on are available to reduce account-takeover risk. Traffic to the Service is encrypted in transit.

If we become aware of a security incident affecting your organization's data, we will notify your organization without undue delay — and in any case within 72 hours of confirming the incident meets this bar — by email to your organization's admin contacts, with what we know at the time: the data involved, our assessment of the impact, and the steps we're taking. We'll follow up as the investigation progresses. This notification is to your organization as the data controller; passing it on to any individuals affected, or to a regulator, is your organization's call to make, informed by what we send you — see our Data Processing Addendum for how this is defined contractually.

You can access, export and correct your account data from within the app. To request deletion of your account or organization data beyond what self-service supports, contact us — see below. Depending on where you're located, you may have additional rights under applicable data protection law.

If your organization needs a DPA (e.g. for GDPR Article 28 purposes), one is available on request — contact us and we'll send it for signature.

The Service runs from a single hosting location — we don't replicate data across regions (see §6). Depending on where your organization and its users are located, using the Service may involve a cross-border transfer of personal data to that location. Our subprocessors are limited to those listed in §4; none of them is itself a cross-border data recipient beyond what's described there. Where a transfer mechanism (e.g. standard contractual clauses) is required by law for your organization, [specific mechanism to be confirmed by legal counsel based on the hosting location and each customer's own location] — in the meantime, it's addressed in the Data Processing Addendum (§9), available on request.

We may update this policy from time to time; material changes will be notified in-app or by email before they take effect.

Questions about this policy, or a data request: complyhub@persol.net.