Security

Company data isolation

Every company's data is scoped and enforced at the database level using row-level security policies — each request is restricted to the data belonging to the authenticated user's own company. This isolation is enforced by the database itself, not only by application code.

Authentication

Accounts are authenticated through Supabase Auth. Sessions are managed via secure, HTTP-only cookies, and access to your company's data requires a valid, verified session.

Role-based access

Within a company, access is scoped by role (owner, admin, or manager). Managers can be restricted to specific locations, so their access reflects the part of the organization they're responsible for.

Payment data

Subscription payments are processed directly by Stripe. ComplyNestly never receives or stores your full card number — card details are handled entirely within Stripe's hosted Checkout and Customer Portal.

Encryption in transit

ComplyNestly is served over HTTPS, so data is encrypted in transit between your browser and our servers.

AI features and your data

AI features such as Ask ComplyNestly, Compliance Copilot, Change Intelligence, and Executive Compliance Briefs operate only on your own company's compliance data — the same row-level-security boundary described above applies to every AI request. These features are decision-support tools: they help you organize, prioritize, and understand your own records faster. They do not provide legal advice, and they do not guarantee compliance with any law, regulation, or standard — you remain responsible for meeting your own regulatory requirements.

Credential handling

Server-side credentials used to operate the application (such as database service credentials and Stripe API keys) are kept in server-only environment configuration and are never exposed to the browser or included in client-side code.

Questions

If you have a security question or want to report a concern, contact us using the details on our Contact page.