Security

Enigma Comply handles sensitive compliance data on behalf of organisations operating under frameworks including ISO 27001, GDPR, and the EU AI Act. Security is not a feature we add at the end — it is the reason customers trust us with their compliance work. This page explains how the platform is built, what controls protect your data, and how to report a security issue.

If you discover a security vulnerability in Enigma Comply, please report it through the contact below. Include a description and a way to reach you so we can investigate and respond. We do not publish a fixed acknowledgement or disclosure timetable.

Please do not use this channel for general support requests. Security issues only.

• Transport encryption. HTTPS traffic uses TLS 1.2 or higher. Public HTTP requests are redirected to HTTPS. HSTS with a two-year max-age is enforced, including subdomains with preload.
• Evidence encryption. Evidence file contents are encrypted by the application before database storage. Production uploads are rejected if the evidence encryption key is unavailable.
• Authentication. All user authentication is managed by Clerk. Multi-factor authentication is supported and recommended.
• Data isolation. Protected workspace operations check organisation access and apply tenant scoping. Public platform endpoints, such as health checks and framework information, do not access a customer workspace.
• API security. Protected workspace API calls require an appropriate credential. Browser workspace requests use the server-side Next.js proxy, which keeps the platform API key out of browser code. A Content Security Policy limits script execution and outbound connections.
• Rate limiting. Free self-assessment submissions are rate limited to reduce abuse. Hosted AI workflows are disabled in this release.
• Audit logging. Audited workspace actions record the action, time, resource and actor where identified. Some events also capture before-and-after details.
• Dependency management. Backend and frontend dependencies are recorded in lockfiles or requirements files and checked for known vulnerabilities in continuous integration.

We do not currently publish an independent penetration-test report for EPG:Comply. Customers with questions about testing and current security controls can contact [email protected].

EPG:Comply does not currently claim Cyber Essentials, ISO 27001 or SOC 2 certification. The security practices described here are not an independent assessment or certification.

UK GDPR and the Data Protection Act 2018 set legal obligations; they are not certifications. See our Privacy Policy for information about how we handle personal data.

AI agent workflows are disabled in the current Early Access release. The customer workflow uses manual assessments, registers and policy templates. If AI features are introduced, their data handling and provider terms will need to be reviewed before activation.

The current release uses the following providers for these service functions.

Customers who require a signed Data Processing Agreement should contact [email protected].

Incident response

We maintain an internal incident response procedure. For personal data we control, we assess whether a breach is reportable and notify the ICO where required, without undue delay and where feasible within 72 hours of becoming aware. When we process customer-controlled data, we notify the customer without undue delay so they can assess their own reporting duties. Affected individuals are informed where required.

Contact

For security issues: [email protected]

For privacy and data protection questions: [email protected]

For enterprise procurement enquiries including DPA, SLA, or pen test report requests: [email protected]