Security and trust
What is true today, and what we are still working on. Compy does not hold an independent security certification yet; our hosting, database and AI model providers hold their own SOC 2 Type II reports.
Today
Data location
Database, files and sign-in are hosted by Supabase in Frankfurt, Germany (AWS eu-central-1). The app runs on Vercel in the same region (fra1).
Tenant isolation
Row Level Security on every table that holds company data: a user of one company cannot read or change another company's rows, even outside the app. Database functions are closed to anonymous callers except the few public pages need (forms, quotes), and each of those checks a link or key of its own.
Encryption
HTTPS/TLS for all traffic. Data, files and backups are encrypted at rest by Supabase (AES-256); passwords are stored as hashes.
Private files
Uploads live in a private, company-scoped bucket and open through signed links that expire after one hour.
Access control
Owner, admin, manager and member roles. AI employee settings, company profile and invitations are owner/admin only.
Backups
Daily database backups, 7 days retained, in the same region.
Export and deletion
Owners and admins download a full copy of their company (every table as JSON and CSV, plus stored files) from the in-app trust center; every member can download their own data. Owners can delete the company: it is suspended for a grace period (30 days by default) they can cancel, then its data and files are deleted. Members can delete their own account; what they wrote stays with the company under "former member".
In-app trust center
Owners and admins see where their data is stored, who can see what by role, members' last sign-in and two-step status, and a security log of role changes, exports and deletion requests.
AI employees
AI employees run on an external AI provider's models through its commercial API. Under its commercial terms, API inputs and outputs are not used to train models and are deleted within 30 days by default. Each request is built from one company's data only; tools run server-side scoped to that company.
AI action log and stop button
Owners see everything each AI employee did (tasks, customer replies, email, posts, every tool call) with the time, who asked and the outcome, exportable as CSV. They can stop one AI employee or all of them at once: the stop is checked before every step, even mid-task, scheduled work waits until they resume, and each stop is logged with who did it and why.
Subprocessors
| Supabase | Database, auth, file storage | EU (Frankfurt) |
| Vercel | App hosting | EU (Frankfurt) + global CDN for static files |
| AI model provider | AI models for AI employees | United States |
| Image and transcription providers | Images for the graphic designer and meeting transcription (not enabled yet) | United States / each provider's infrastructure |
| Unsplash, Pixabay and Pexels | Free stock photos for designs and AI employees' work; they receive English search words only, never company data (when enabled) | Each provider's infrastructure |
| LiveKit | Audio meeting rooms (when enabled) | Nearest server to participants |
| Paymob | Card payments (test mode until live payments start) | Egypt |
| Meta | WhatsApp and Facebook/Instagram, when a company connects them | Meta infrastructure |
| Resend | Email to the Compy team on human-handoff requests (not enabled yet) | United States |
Roadmap
- Data export and deletion. Live: self-service from the in-app Trust center.
- Data region choice. Live: shown when you set up your company and in the company profile (EU - Frankfurt).
- Saudi Arabia / Gulf region. Planned: a separate deployment with its database in the region, for PDPL and sector requirements.
- Security policies. In progress: information security, access control, incident response, data retention.
- ISO 27001. Planned as our first certification; SOC 2 to follow when international customers ask for it.
- Two-step verification (MFA). Live: anyone can turn on an authenticator app with recovery codes; company owners can require it for the whole team, and the database itself refuses company data to a password-only session.
- Independent penetration test. Planned.
Found a security issue? Write to us from the contact page with "Security report" at the top. We acknowledge reports within two business days. Last updated October 13, 2026.