Security
Effective September 13, 2026
ComplyCue exists to hold the documents that keep a business licensed to operate \u2014 contractor licenses, insurance certificates, bonds, permits. We treat that responsibility accordingly. This page summarizes the technical and organizational controls we use to protect your data.
Encryption everywhere
All traffic between your browser and ComplyCue is encrypted with TLS. Documents in your Compliance Vault and every database record are encrypted at rest by our infrastructure provider.
Row-level security by default
Every table holding customer data enforces PostgreSQL row-level security (RLS) policies scoped to your organization ID. Even if application code has a bug, the database itself refuses to return another organization's rows.
Role-based access control
Access follows four roles — owner, admin, manager, and viewer — enforced at the database layer via RLS policies, not just hidden in the UI. Only admins and owners can manage team membership or delete documents.
Audit logging
Every meaningful state change — a status change, a document attached, a note added, a team member added or removed — is written to an append-only activity log tied to the acting user, visible to your organization's admins.
Private document storage
Uploaded licenses, permits, and insurance certificates live in a private storage bucket (never publicly listable), namespaced under your organization's unique ID, with signed URLs issued only to authenticated, authorized requests.
Vetted infrastructure
ComplyCue is built on Supabase (Postgres, auth, storage) and hosted on Vercel — providers with their own independent security programs — rather than self-managed infrastructure.
Data isolation
Every organization's data — locations, documents, obligations, activity logs — is scoped by an org_id. Our Postgres row-level security policies check organization membership on every read and write, so a compromised or misconfigured client can never retrieve another customer's compliance data. Two privileged operations bypass RLS by design and are tightly restricted: cron jobs that generate renewal reminders, and admin tooling used by our own support team, both of which explicitly filter by organization ID in code and are never exposed to end users directly.
Document handling
Files you upload to the Compliance Vault are stored in a private Supabase Storage bucket. Storage policies require every object path to be prefixed with the uploading organization's ID, and only members of that organization with at least “manager” role can upload; deletion requires “admin” role or above. Files are never publicly listable or guessable by URL.
AI document extraction
When you upload a license or permit, our extraction pipeline reads the document to suggest structured fields (license number, issue date, expiration date) and attaches a confidence score to each one. Low-confidence fields are left blank rather than guessed — we never silently invent a date, fee, or license number. You always confirm extracted values before they become part of your compliance record of truth.
Regulatory data integrity
Our public regulatory knowledge base — the same data that powers the free License & Permit Checker and your onboarding results — is maintained with a confidence label (confirmed, likely applicable, or needs verification), an issuing agency, an official source URL, and a last-verified date on every entry. Administrative edits to this knowledge base are recorded in a dedicated audit log capturing who changed what and when.
Account security
- Authentication is handled by Supabase Auth; passwords are never stored in plain text.
- Session cookies are HTTP-only and validated on every request through server-side middleware.
- Sensitive server-side operations (admin routes, cron/webhook handlers) use a separate service-role credential that is never exposed to the browser.
Responsible disclosure
If you believe you have found a security vulnerability in ComplyCue, please email security@complycue.com with details. We ask that you give us a reasonable opportunity to investigate and remediate before any public disclosure, and we will not pursue legal action against good-faith security research conducted under this policy.
Not legal or compliance advice
ComplyCue provides compliance tracking assistance and general information about regulatory requirements. It is not a substitute for legal, tax, or professional advice. Requirements marked "Needs Verification" or "Likely Applicable" have not been confirmed against an authoritative source and should be independently verified with the relevant agency before you rely on them.