ComplyCube

ComplyCube hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

ComplyCube publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but ComplyCube is SOC 2 compliant and holds ISO 27001, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

ComplyCube hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@complycube.com or via a /security page (ComplyCube lists a security contact).

ComplyCube lists 3 subprocessors on its trust center, including Amazon Web Services, Google Cloud Platform, MongoDB, Inc.. Buyers use this for fourth-party risk review.

ComplyCube hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Business information, Biometric data. Data residency details are on its trust center.

ComplyCube's trust center is at https://trust.complycube.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

As a data processor (rather than a data controller) under GDPR, ComplyCube does not own, control or direct the use of any Client Data stored or processed by a Client or User via the Service. Only the Client or Users are entitled to access, retrieve and direct the use of such Client Data. Our Privacy Policy, referenced at the top of this page, details the data we collect, how we use this information, and how long we retain it for.

Data is stored in secure cloud regions across the globe, specifically in the United States, the European Union, and the Middle East, in strict adherence to relevant data residency laws and requirements. This regional deployment strategy ensures that we align with the specific needs and locations of our customers. Additionally, we provide our large enterprises with the option to leverage additional cloud regions, including APAC, Africa, and LATAM, offering a customized solution to meet their unique demands.

Your rights and obligations regarding the sharing of data with third parties and the use of Sub-processors are covered in clauses 3 and 8 of our Data Processing and Information Security Addendum (DPISA), which is attached to our Master Services Agreement (MSA). Clause 2.5 of the MSA details agreements regarding the sharing of information with third parties in relation to the service, while clause 8 details the receiving parties' obligations when holding confidential information. If you would like to request a copy of our MSA, you can do this through your ComplyCube representative or by emailing us at trustcenter@complycube.com

Yes - all employees go through criminal, background and right-to-work checks by a reputable third party as part of the employee onboarding process. Additionally, we look at the previous experience of the candidate and perform a rigorous culture and technical interview to ensure the person is a correct fit. Screening checks are in line with the BS 7858:2019 standard.

Yes - ComplyCube encrypts all sensitive data in transit using TLS 1.2 at minimum with common secure ciphers and encrypts data at rest using AES-256.

Yes - We are externally audited by accredited organisations at least yearly against each of the standards we are certified for, including ISO 27001, ISO 30107-3, Cyber Essentials, ACCS 2:2021 Technical Requirements for Data Protection & Privacy, and ACCS 4:2020 Technical Requirements for Age Check Systems (incorporating PAS 1296:2018 Code of Practice for Age Check Systems). We also undertake periodic internal audits across the organisation to ensure our systems and controls are working as they should, which is reported on. All non-conformities and risks identified are then ticketed and resolved to ensure they are mitigated. If you have specific concerns or questions, please get in touch.

ComplyCube has a risk management program in place and performs an annual company-wide risk assessment in addition to quarterly followup meetings with risk owners. We use Vanta to manage and track these risks as they are mitigated and treated. Please see our Risk Assessment policy for further information.

We conduct penetration testing annually. Once we have an NDA in place, we can share a summary of our results.