Security · Written by Yobel Tzegai · Last checked 3 November 2026

What is in Complipath's security pack?

Complipath's security pack (complipath.io) is one page with a source on every row: the Data Processing Agreement, the sub-processor list, where the data is kept, AES-256 at rest, a breach notice within 48 hours, daily backups, the status page, what reaches our AI provider and how you leave.

Get my risk classes, freeBook a 20-min call20 minutes with the founder.

Contracts and where the data is

Contracts, location and encryption, each with the document it is read from
Topic	What the document says	Source
Data Processing Agreement	Made under Article 28 of the GDPR and part of the Terms of Service; version 1.1, dated 2 November 2026.	DPA
Sub-processors	The companies that process personal data for customers, each with its purpose, location and transfer basis: Supabase, Vercel, Anthropic, Perplexity, Resend, Stripe and Google Workspace. A new one is announced at least 30 days before it starts.	Subprocessors
Where the data is	The database, sign-in and file storage at Supabase in Frankfurt (eu-central-1); the server functions at Vercel in Frankfurt (fra1). The list was read on 29 October 2026.	Subprocessors
Encryption	The database and file storage are encrypted at rest with AES-256 by the database provider; traffic is served only over HTTPS, with HTTP Strict Transport Security.	DPA, Annex 2; Supabase security, read 28 October 2026

Incidents, backups and uptime

Incidents, backups and uptime, each with the document it is read from
Topic	What the document says	Source
Breach notice	A personal data breach is notified without undue delay, and at the latest 48 hours after Complipath becomes aware of it, with what Article 33(3) of the GDPR asks for as far as it is known.	DPA, section 5.2
Incident routine	Contain, tell, fix and restore, explain. The aim is a first report to affected customers within 24 hours, and a written cause report within two weeks.	Backup and incident response
Backups	The database is backed up once a day by the database provider, each backup kept for seven days in the same Frankfurt region, and its write-ahead log is archived continuously. Uploaded files are kept redundantly by the storage provider, with no second copy elsewhere.	Backup and incident response
Restore test	None has been done yet. The practices page says one is planned: the latest backup restored into a separate project and the row count of every table compared with the live database.	Backup and incident response
Uptime	The app, its API and its database are checked automatically twelve times an hour, and every declared incident is listed.	Status page

Sign-in, AI and your data

Sign-in, the AI switch, export and deletion, each with the document it is read from
Topic	What the document says	Source
Two-step sign-in	Available to every user with an authenticator app; a workspace owner can require it for everyone.	DPA, Annex 2
AI off	A workspace owner can turn AI off in Settings. Nothing from that workspace is then sent to the language model provider.	Terms, section 13.5
Export	You can export your data at any time, including while a workspace is paused.	Terms, section 15.2
Deletion	An owner who deletes the workspace in Settings deletes it at once; copies in backups are overwritten within seven days.	Terms, section 15.4

What reaches Anthropic, and what stays with us

Anthropic runs the AI features.
A questionnaire you upload is read on Complipath's own server and is not sent.
For an answer draft, the question goes with the matching sources: register facts, statements made in the app and the passages of your files the answer is linked to, at most 30 passages and never a whole file.

One case sends more.
A file added on the Evidence page or to Documentation has its extracted text sent, up to 120,000 characters, so its passages can be found.
With AI off, nothing is sent and files are searched on our own server.
The feature-by-feature list is in Annex 3 of the DPA.

Transfer: Anthropic Ireland, Limited processes for customers in the EEA, Switzerland and the UK. Its processing is global, under standard contractual clauses, modules 2 and 3, in Anthropic's data processing agreement, and inputs and outputs are deleted within 30 days, as the Subprocessors list says; it was read on 29 October 2026.

Training: Anthropic's own Commercial Terms of Service, effective 17 June 2025 and read on 29 October 2026, say in section B that Anthropic may not train models on Customer Content from Services.

Is your data used to train the AI?

The AI we use is never trained on your data, and no model is fine-tuned on it.
Our AI providers process your data only to return an answer to us and, under their terms with us, do not use it to train their models.
Both sentences are section 4 of our DPA.

Certificates and tests

There is no SOC 2 or ISO 27001 report, and no external penetration test, yet.

What exists instead: an assessment of Complipath's own AI with the same engine customers use, published as Complipath's own AI, assessed, version 1.0, and the measures listed in Annex 2 of the DPA.
No date is promised for a certificate.

If you leave

Your data comes out in open formats whenever you want it: the whole register as a spreadsheet, as JSON or as a PDF, and every table the workspace holds as one JSON file.
When the agreement ends you can export for 30 days.
The workspace is then deleted within 30 days, and copies in backups are overwritten within seven days after that (Terms, section 15.3).

Download the pack

The whole page as one PDF, for your vendor file: Complipath security pack (PDF).

Starter

€499 a month

or €4,990 a year. Prices exclude VAT.

Up to 20 AI systems
Evidence and the audit log
The Free plan is for one AI system and one user, with no end date

Get my risk classes, free

All plans

Questions

Does Complipath have SOC 2 or ISO 27001?

No, not yet. There has been no external penetration test either. What exists instead is the Data Processing Agreement with its technical measures in Annex 2, a published assessment of Complipath's own AI and this page, where every row links to the document it is read from. No date is promised for a certificate.

How fast are we told about a personal data breach?

Without undue delay, and at the latest 48 hours after Complipath becomes aware of it, under section 5.2 of the app's Data Processing Agreement. The practices page adds an aim of a first report within 24 hours for any incident that affects your data or access, and a cause report within two weeks.

What do Anthropic's terms, read on 29 October 2026, say about training?

Anthropic's Commercial Terms of Service, effective 17 June 2025, say in section B that Anthropic may not train models on Customer Content from Services. Inputs and outputs are deleted within 30 days, according to the sub-processor list read the same day, and an owner can turn AI off for the whole workspace.

Has a backup ever been restored?

Not yet. The database is backed up daily and each backup is kept for seven days in Frankfurt. The app's practices page says a restore test is planned: the latest backup restored into a separate project and every table's row count compared with the live database. Its date and result will be written there.