Security

Enigma Comply handles sensitive compliance data on behalf of organisations operating under frameworks including ISO 27001, GDPR, and the EU AI Act. Security is not a feature we add at the end — it is the reason customers trust us with their compliance work. This page explains how the platform is built, what controls protect your data, and how to report a security issue.

We operate a responsible disclosure policy. If you discover a security vulnerability in Enigma Comply, please report it to us before disclosing it publicly. We will acknowledge your report within 48 hours, keep you informed of our progress, and credit you in our disclosure once the issue is resolved.

Please do not use this channel for general support requests. Security issues only.

• Transport encryption. All traffic is served exclusively over TLS 1.2 or higher. HTTP connections are rejected at the Cloudflare and Vercel edge. HSTS with a two-year max-age is enforced, including subdomains with preload.
• Encryption at rest. Evidence files and SSO certificates are encrypted with AES-256 before storage. PostgreSQL databases are encrypted at rest by the hosting provider (Railway).
• Authentication. All user authentication is managed by Clerk, a SOC 2 Type II certified identity provider. Sessions use short-lived JWTs. Multi-factor authentication is supported and recommended.
• Data isolation. Every API request is scoped to a single organisation. The backend enforces ownership checks on every route — it is not possible to read or write another organisation's data, even with a valid session token.
• API security. The backend API requires a bearer token on every call. The token is injected server-side by the Next.js proxy and is never exposed to the browser. A Content Security Policy prevents exfiltration of tokens via XSS.
• Input sanitisation. All user-supplied inputs that reach AI agents are sanitised to remove prompt-injection payloads before processing. Maximum input lengths are enforced at both the API and AI layer.
• Rate limiting. Per-organisation request rate limits are applied to all AI endpoints to prevent abuse and ensure fair access across tenants.
• Audit logging. Every material action (control update, risk change, member invite, data export) is recorded in an append-only audit log with actor, timestamp, and before/after state.
• Dependency management. Backend and frontend dependencies are pinned to specific versions and reviewed for security advisories on an ongoing basis.

We plan to commission an independent penetration test by Q4 2026. Results and remediation status will be summarised and shared with Enterprise customers on request under NDA. Customers requiring a copy of the test report should contact [email protected].

We are honest about our current certification status. A platform that sells compliance advisory services must hold itself to the same standard it recommends to its customers.

AI agent workflows are disabled in the current Early Access release. The customer workflow uses manual assessments, registers and policy templates. If AI features are introduced, their data handling and provider terms will need to be reviewed before activation.

We use the following sub-processors to deliver the service. All international transfers to the USA are covered by Standard Contractual Clauses (SCCs) or the UK International Data Transfer Agreement (IDTA).

Customers who require a signed Data Processing Agreement should contact [email protected].

Incident response

We maintain an internal incident response procedure aligned with GDPR Article 33/34 obligations. In the event of a personal data breach, we will notify the ICO within 72 hours of becoming aware and notify affected individuals without undue delay where required. We will notify affected customers as soon as practicable.

Contact

For security issues: [email protected]

For privacy and data protection questions: [email protected]

For enterprise procurement enquiries including DPA, SLA, or pen test report requests: [email protected]