Controls
Each statement below is checked by automated tests that read the code. The status says how far that check goes.
Sign-in and access
Who can get into an account, and how.
-
Checked Checked 2026-10-09
You sign in with your GitHub or Google account. COMPLiTT does not store passwords.
Your identity provider handles your password and any two-step verification you have turned on.
How we checked: The sign-in code uses GitHub and Google only. No password storage was found.
-
Checked Checked 2026-10-09
Your session cookie is marked HTTP-only and Secure, and carries same-site protection, so page scripts cannot read it and browsers send it only over HTTPS.
How we checked: The cookie settings in the sign-in code were read. We have not inspected them in a live browser for this page.
Your data
How the information you give us is kept.
-
Partly checked Checked 2026-10-09
Each customer's data is separate from every other customer's. Automated tests act as one customer and try to read another's data; they must be refused.
How we checked: The cross-customer test suite exists. It needs a live database, and it was not run for this page.
-
Checked Checked 2026-10-09
Credentials you give us for integrations, such as mail settings and GitHub tokens, are encrypted with AES-256-GCM before they are stored.
How we checked: The encryption method and its use at the storage step were read. Key rotation is not described here.
-
Checked Checked 2026-10-09
Files you upload as evidence are private to your account. Uploads use short-lived signed links.
How we checked: The access rules and signed-link code were read.
The application
Protections built into the product itself.
-
Checked Checked 2026-10-09
Everything is served over HTTPS, and browsers are instructed to insist on it (HTTP Strict Transport Security).
How we checked: The HTTPS redirect and the strict transport header were read.
-
Checked Checked 2026-10-09
Actions that change your data are protected against cross-site request forgery.
How we checked: The protection was found attached to the routes that change data.
How we scan
What our scanner will and will not do to a site.
-
Checked Checked 2026-10-09
The most intrusive checks, such as port probing, request bursts and zone-transfer attempts, run only against domains you have verified you own.
Other checks use the kind of requests an ordinary visitor or search engine makes.
How we checked: Every intrusive check in the scanner was confirmed to require verified domain ownership.
AI features
Where AI-assisted features run.
-
Checked Checked 2026-10-09
AI-assisted features in the hosted service run on Cloudflare's own AI platform. Your content is not sent to a separate AI vendor.
How we checked: AI calls were found going to the Cloudflare AI platform, and to no other AI vendor.
Running the service
Resilience and record-keeping.
-
Partly checked Checked 2026-10-09
Database changes are archived continuously to storage separate from the application, and full backups are taken on a schedule.
How we checked: The backup scripts exist. We have not published restore results, so the backups are unproven until a restore is tested.
-
Checked Checked 2026-10-09
Security-relevant actions on an account are recorded in an audit log.
How we checked: Audit calls were found in the main request handlers.
Not in place
We would rather you read these here than find them later.
- No certification. We have no SOC 2, ISO 27001 or other audit report. We do not claim one.
- No independent penetration test. None has been commissioned or published.
- No published restore test. Backups are archived continuously, but we have not published a restore test, so we cannot yet show a backup restores.
- The web app still allows inline scripts. The main application's browser policy still allows inline code and eval. This trust center uses no scripts and a strict policy.
- No incident response or continuity evidence. We have not published an incident response plan, and we have not tested business continuity.
- Staff access to production is not described. How staff are granted and reviewed access to production systems is not yet written up here.
- Our checks are code checks, not behaviour tests. They confirm the code matches each statement. They do not attack the running service from outside. Only a penetration test does that.
Subprocessors
Vendors that handle customer data on COMPLiTT's behalf.
| Vendor | Purpose | Data | When |
|---|---|---|---|
| Cloudflare | Hosting, network edge, file and backup storage, email delivery and AI features | Everything you store in COMPLiTT, in transit and at rest | Always |
| GitHub | Sign-in, and repository access if you connect one | Your GitHub profile and email; repository data you choose to share | If you sign in with GitHub or connect a repository |
| Sign-in | Your Google profile and email | If you sign in with Google | |
| Stripe | Payment processing for paid features | Billing details, handled by Stripe; COMPLiTT does not see full card numbers | Only if you use a paid feature |
Updates
- Trust center published. It states what is not in place as plainly as what is.
- Security statements last checked against the code. They are re-checked at least every 180 days.