Security · Written by Yobel Tzegai · Last checked 9 October 2026

How does Complipath handle security and your data?

Complipath (complipath.io) keeps your workspace in Frankfurt: the database in Supabase eu-central-1 and the server functions in Vercel's Frankfurt region, read on 8 October 2026. The owner can require two-step sign-in for everyone. Every party that receives data is named with what it receives, and you can take everything out or delete the workspace yourself.

Check your AI systems, free

Where is the data hosted?

The database is in Supabase's eu-central-1 region and the app's server functions run in Vercel's fra1 region, both Frankfurt, read on 8 October 2026 in the app's configuration and its database project.
The Anthropic row of the subprocessors page says where our AI provider processes what it receives, and that is not only the EU.

How does sign-in work?

Three ways to sign in: an email link, a password, or a Google account.
Two-step sign-in: after the first step you type a 6-digit code from an app on your phone. The owner can require it for everyone in the workspace.
Ten recovery codes, stored only as hashes.

Who receives what?

Eight parties, each on the subprocessors page with the fields it receives, the day its row was read and what is still unread about it. That page is the list; this one does not repeat it.

Can we turn AI off?

Yes. One switch in Settings stops every call to our AI provider, Anthropic, for your whole workspace. Only the owner can change it. The classification never used a model, so it works the same either way: how the AI switch works.

Is there an audit log?

Yes: who did what in the workspace, and when, with a CSV export. The database lets a line be read and added, never edited or deleted, not even by an owner.
Deleting the workspace deletes its log with everything else.
It is in Starter and the trial, not in Free.

How do we take our data out?

One JSON file with every table your workspace holds, from Settings, whenever you want it. The few tables withheld from it are named in the file.
Download everything, on the dashboard, gives a ZIP with one assessment PDF per system and an overview as PDF and CSV.
The register, each assessment, the Annex IV documentation, the AI literacy record and the audit log also export on their own.

What happens when we delete the workspace?

It is removed at once, with everything in it, for everyone in it. Its files are removed from storage. There is no grace period, and nothing in the app brings it back.
Your sign-in identity is a separate record at our authentication provider, and deleting a workspace does not remove it.
What our database provider keeps in backups, and for how long, has not been read since the plan changed; it is on the unread list of the subprocessors page.

What we have not read

This page does not claim encryption at rest at our providers, because we have not read their terms on it. Every such question is on the unread list of the subprocessors page, with where it can be read.

Starter

€499 a month

Prices exclude VAT.

Up to 20 AI systems
Every duty, deadline and article
Evidence and the audit log
Your first system is free, with no end date

Check your AI systems, free

All plans

Questions

Where is Complipath hosted?

In Frankfurt. The database is in Supabase's eu-central-1 region and the app's server functions run in Vercel's fra1 region, read on 8 October 2026. What our AI provider receives is processed where Anthropic processes it, which is not only the EU; the subprocessors page says so on its row.

Can the owner require two-step sign-in for everyone?

Yes. After the first step, each person types a 6-digit code from an authenticator app on their phone, and the owner can make that required for the whole workspace. It is checked on every request and in the database, and each person gets ten recovery codes, stored only as hashes.

Can we delete everything ourselves?

Yes. The owner deletes the workspace from Settings after typing its name, and it is removed at once with its files, with no grace period. Download the file first: nothing in the app brings it back. Your sign-in identity is a separate record and is not removed by deleting the workspace.

Which security questions does this page not answer?

Encryption at rest at our providers, what our database provider keeps in backups and for how long, and the other terms we have not read. Each is on the unread list of the subprocessors page with where it can be read, because a guess about a supplier is not an answer.