Is this your company? Buyers are checking ComplyCube here. Claim complycube.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
ComplyCube
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
ComplyCube is SOC 2 compliant. ComplyCube also holds ISO 27001, GDPR, and CCPA.
About
ComplyCube is a RegTech100 all-in-one platform for automating Identity Verification (IDV), Anti-Money Laundering (AML), and Know Your Customer (KYC) processes, with global customers across legal, telecoms, financial services, healthcare, e-commerce, cryptocurrency, travel, and more. This live, public dashboard demonstrates ComplyCube's current security & compliance posture in line with its commitment to building trust at scale.
Compliance & infrastructure
Hosting
AWSGCP
Data handled
Customer personally identifiable informationEmployee personally identifiable informationBusiness informationBiometric data
Documents
8Subprocessors
3- AAmazon Web Services · Cloud Infrastructure
- GGoogle Cloud Platform · Cloud Infrastructure
- MMongoDB, Inc. · Data storage and processing
Compliance leadership
The person who leads ComplyCube's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. ComplyCube's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is ComplyCube SOC 2 compliant?
ComplyCube is SOC 2 compliant. On SOC2C this listing is Listed.
Is ComplyCube ISO 27001 certified?
According to ComplyCube's public trust center, ComplyCube is ISO 27001 certified. On SOC2C this listing is Listed.
Is ComplyCube GDPR compliant?
According to ComplyCube's public trust center, ComplyCube is GDPR compliant. On SOC2C this listing is Listed.
Is ComplyCube CCPA compliant?
According to ComplyCube's public trust center, ComplyCube is CCPA compliant. On SOC2C this listing is Listed.
Can I use ComplyCube's SOC 2 for a vendor risk assessment?
Yes. ComplyCube's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is ComplyCube penetration tested?
ComplyCube hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Does ComplyCube have an ISO 27001 certificate?
ComplyCube publishes an ISO certificate on its trust center; you can request access through SOC2C.
Is ComplyCube secure?
Security isn't a single yes/no, but ComplyCube is SOC 2 compliant and holds ISO 27001, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does ComplyCube have a bug bounty or vulnerability disclosure program?
ComplyCube hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@complycube.com or via a /security page (ComplyCube lists a security contact).
Who are ComplyCube's subprocessors?
ComplyCube lists 3 subprocessors on its trust center, including Amazon Web Services, Google Cloud Platform, MongoDB, Inc.. Buyers use this for fourth-party risk review.
Where does ComplyCube host or store data?
ComplyCube hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Business information, Biometric data. Data residency details are on its trust center.
Where is ComplyCube's trust center or security page?
ComplyCube's trust center is at https://trust.complycube.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by ComplyCube
Reproduced from ComplyCube's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Do you collect, create, use or store our data and how?
As a data processor (rather than a data controller) under GDPR, ComplyCube does not own, control or direct the use of any Client Data stored or processed by a Client or User via the Service. Only the Client or Users are entitled to access, retrieve and direct the use of such Client Data. Our Privacy Policy, referenced at the top of this page, details the data we collect, how we use this information, and how long we retain it for.
Where is our data stored?
Data is stored in secure cloud regions across the globe, specifically in the United States, the European Union, and the Middle East, in strict adherence to relevant data residency laws and requirements. This regional deployment strategy ensures that we align with the specific needs and locations of our customers. Additionally, we provide our large enterprises with the option to leverage additional cloud regions, including APAC, Africa, and LATAM, offering a customized solution to meet their unique demands.
Will data be shared or disclosed to any third parties?
Your rights and obligations regarding the sharing of data with third parties and the use of Sub-processors are covered in clauses 3 and 8 of our Data Processing and Information Security Addendum (DPISA), which is attached to our Master Services Agreement (MSA). Clause 2.5 of the MSA details agreements regarding the sharing of information with third parties in relation to the service, while clause 8 details the receiving parties' obligations when holding confidential information. If you would like to request a copy of our MSA, you can do this through your ComplyCube representative or by emailing us at trustcenter@complycube.com
Are your employees vetted?
Yes - all employees go through criminal, background and right-to-work checks by a reputable third party as part of the employee onboarding process. Additionally, we look at the previous experience of the candidate and perform a rigorous culture and technical interview to ensure the person is a correct fit. Screening checks are in line with the BS 7858:2019 standard.
Does ComplyCube encrypt data at rest and in transit?
Yes - ComplyCube encrypts all sensitive data in transit using TLS 1.2 at minimum with common secure ciphers and encrypts data at rest using AES-256.
Are you externally audited?
Yes - We are externally audited by accredited organisations at least yearly against each of the standards we are certified for, including ISO 27001, ISO 30107-3, Cyber Essentials, ACCS 2:2021 Technical Requirements for Data Protection & Privacy, and ACCS 4:2020 Technical Requirements for Age Check Systems (incorporating PAS 1296:2018 Code of Practice for Age Check Systems). We also undertake periodic internal audits across the organisation to ensure our systems and controls are working as they should, which is reported on. All non-conformities and risks identified are then ticketed and resolved to ensure they are mitigated. If you have specific concerns or questions, please get in touch.
Does ComplyCube maintain a risk management program, perform risk assessments, and track the treatment of those risks?
ComplyCube has a risk management program in place and performs an annual company-wide risk assessment in addition to quarterly followup meetings with risk owners. We use Vanta to manage and track these risks as they are mitigated and treated. Please see our Risk Assessment policy for further information.
How often do you conduct penetration testing? Can you send us your results?
We conduct penetration testing annually. Once we have an NDA in place, we can share a summary of our results.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public