Security
ComplySquare holds a chartered accountancy firm’s entire client book. What follows is what we actually do, stated without adjectives — and with the limits named, because a security page that names no limits is not describing a real system.
Your data stays in India
The database runs in Amazon Web Services' Mumbai region (ap-south-1) through Supabase, and the application's server functions are configured for Mumbai. Two things are processed outside India and we would rather name them than imply otherwise: transactional email delivery, and error diagnostics, which are hosted in the European Union and are configured to strip identifiers — email addresses, phone numbers, PAN, TAN and GSTIN — before anything leaves the application.
Firm isolation is enforced in the database
This is the one we would ask you to check hardest, because it is where most multi-tenant systems are weakest. Separation between firms is not implemented in application code. It is PostgreSQL row-level security: every query runs under the signed-in person's own identity, against policies in the database, on a connection whose login role owns nothing. There is no code path in ComplySquare that reads a client row and then filters it for permission afterwards, because there is no query that can return another firm's row in the first place.
Encryption in transit and at rest
Traffic is served over TLS. Data at rest is encrypted by the managed database and storage platform.
Access is invite-only
There is no public sign-up. A person joins a firm because someone in that firm invited them by email; they set their own password from a link that expires, and they can reset it themselves afterwards. When someone leaves, their access is removed by their own firm's administrator, not by us.
Support access is audited, and visible
We do not have standing access to your data. When support genuinely requires it, a platform operator can enter a firm's surface through an explicit, time-limited mechanism that is flagged in the interface for as long as it is active and recorded in an audit log — who, what, and when. That record belongs to the firm and the firm can read it.
Backups
The database is backed up automatically every day, and each backup is retained on a rolling window. A manual snapshot is also taken before any change that touches the production database.
Who else touches your data
| Provider | What it does | Where it processes |
|---|---|---|
| Supabase, on Amazon Web Services | Database and authentication | India — Mumbai (ap-south-1) |
| Vercel | Application hosting and delivery | Server functions configured for Mumbai; global content delivery |
| Resend | Transactional email | Outside India |
| Sentry | Error monitoring | European Union |
This list is the same one in our privacy policy, and it changes there first.
What we do not claim
No system is guaranteed secure, and we do not offer an uptime or availability commitment — ComplySquare is in early access and our terms say so plainly. Your own practices matter as much as ours: who your administrators invite, how quickly departed staff are removed, and the security of the devices your team signs in from.
Questions about any of this go to hello@leopathway.com.