Encryption in transit
All traffic between your browser and the platform is encrypted with SSL/TLS.
Security at Complitude
Complitude is used by financial institutions and other regulated businesses, so protecting their data is a core part of how we run the platform. This page describes our main security measures and the suppliers and subprocessors involved in delivering the service.
Last updated: 8 October 2026
Our approach
Complitude is operated from Poland by Compliance Services Michał Sobczak. We process personal data in line with the GDPR. For data of Users entered by our Clients, we act as a data processor on the Client's instructions, under a Data Processing Agreement (DPA) that forms part of the contract.
Security measures
Access control
Access is limited to authorised Users. Organisation Administrators manage the Users of their own organisation, and accounts are protected by password policies.
Two-factor authentication
Users can protect their account with two-factor authentication using an authenticator app, with one-time recovery codes in case the device is lost.
Application protection
Pages are served with security headers, including a Content Security Policy. Forms are protected against automated abuse by a self-hosted ALTCHA challenge, so no third-party CAPTCHA service sees your visitors.
Backups
Platform data is backed up regularly to protect against loss.
Risk assessments
We carry out regular risk assessments and adjust our technical and organisational measures accordingly.
Certificate integrity
Every certificate we issue can be checked by anyone using its ID or QR code on our verification page.
Verify a certificate →Incident response
If a personal data breach occurs, we assess it, take steps to contain it and notify the affected Client without undue delay, in line with the GDPR and the DPA.
Data retention and deletion
We keep personal data only as long as needed for the purposes described in our Privacy Policy and required by law. When the contract ends, Clients can ask us to delete or return their data.
AI features
Complitude includes AI-supported features: the AI Help Centre, an AI assistant for your compliance data (queries, first drafts, regulatory horizon scanning and gap analysis) and AI-assisted triage of whistleblowing reports. To handle a request, these features send the text needed to process it to the AI service provider listed below. AI output is a draft that supports, but does not replace, human judgement: it must be verified before use and is not legal advice. No decision with legal effect is taken automatically.
Subprocessors and suppliers
To run the platform we use the suppliers listed below. Our learning management system (LMS) is built and operated by Complitude, training content is delivered as SCORM-compliant packages on our own platform, and bookkeeping and usage analytics are handled in-house. No external LMS, accounting or analytics provider therefore receives personal data. Subprocessors are suppliers that process personal data on our behalf. For data entered by our Clients, they act under agreements that impose data protection obligations equivalent to those in our DPA. Where a supplier is located outside the EEA or may transfer data there, we apply the Standard Contractual Clauses (SCC) approved by the European Commission.
Subprocessors
Suppliers that process personal data on our behalf in order to deliver the service.
| Supplier | Purpose | Data processed | Location |
|---|---|---|---|
| SEOHOSTHosting and e-mail provider | Hosting of the platform, our custom-built LMS, SCORM training content and the database, and sending of account, notification and certificate e-mails. | All platform data: account details, training progress and results, certificates, and the e-mails the platform sends. | Poland (EEA) |
| Stripe Payments Europe, Ltd.Online payment operator | Processing of Licence Fee payments. | Payer and billing details. Payment card data is processed by the operator and is not stored by Complitude. | Ireland (EEA). Transfers to the USA are covered by SCC. |
| Google (Gemini API)AI service provider | Processing of requests made through the AI features described above. | The text of the request and the compliance content needed to answer it, such as policies, registers and whistleblowing report content. | May be processed outside the EEA (e.g. USA). Transfers are covered by SCC. |
Other services and integrations
Optional integrations and technical services that are not used to store Client data.
| Supplier | Purpose | Data processed | Location |
|---|---|---|---|
| Optional integration for sharing achievements. Used only if the User chooses to connect it. | Only what the User chooses to share, such as certificate details in a post. | Ireland (EEA). Transfers to the USA are possible. | |
| ALTCHABot protection (self-hosted) | Bot protection on forms. Runs on our own infrastructure; no data is sent to a third party. | Bot-check challenge data only. It stays on our servers. | Our own infrastructure |
| jsDelivrContent delivery network (CDN) | Delivery of open-source scripts and icon fonts used by the application interface. | IP address and browser details of the visitor when these files load. | Global CDN network |
| GitHub | Hosting of the platform source code and version control. | Source code only. No personal data is stored in the repository. | USA |
Changes to this list
We keep this list up to date. If we add or replace a subprocessor, we update this page and inform Clients in line with the DPA, so that they have the opportunity to raise objections.
Questions or security reports
For security questionnaires, a copy of the DPA, or to report a suspected vulnerability, write to us and we will respond as soon as possible.