Trust Center

Infrastructure and hosting

Managed cloud hosting

The API, dashboard, and email renderer run as isolated container services on Railway with a managed PostgreSQL database; the marketing site (this one) runs on Vercel. There are no self-managed servers.

Servers in the United States

Production services and the database are located in the United States, as stated in the privacy policy. EEA, UK, and Swiss transfers are covered by the European Commission's Standard Contractual Clauses.

Private service-to-service networking

Traffic between backend services stays on Railway's private network and never crosses the public internet. Only the API, dashboard, and marketing site have public domains; the email renderer has none.

Automated, health-gated deploys

Every deploy runs database migrations before the new version starts, and Railway only cuts traffic over once the health check confirms the API can reach the database. A failed migration fails the deploy rather than serving a half-migrated app.

Encryption and network security

TLS everywhere public

api.compliapi.com, app.compliapi.com, and compliapi.com are served over HTTPS with TLS terminated at the hosting provider's edge. The API is only reachable through that edge.

Separate trust boundaries per surface

The dashboard API, the public screening API, the MCP server, and the Stripe webhook receiver are mounted as separate applications with their own authentication, CORS policy, and rate limits. The dashboard API accepts browser requests only from the dashboard's own origin.

Secrets outside the code

Signing keys, database credentials, and third-party API keys live only in per-service environment configuration, never in the repository or container images. Purpose-specific signing secrets are derived per use (email verification, password reset, OAuth tokens) so one cannot be replayed as another.

Authentication and access control

API tokens are hashed at rest

Only the SHA-256 hash of an API token is stored, plus a short display prefix. The plaintext is shown once at creation and cannot be recovered afterwards — if it is lost, revoke it and create a new one from the dashboard.

Password hashing and policy

Passwords are hashed with Argon2 and are never stored or logged in plaintext. The policy — at least 12 characters with letters, numbers, and symbols — is enforced server-side on signup, reset, and change, not just in the browser.

Verified email before any access

Every dashboard endpoint requires a verified email address, so an unverified signup cannot read or create anything. Dashboard sessions are 24-hour signed JWTs.

Organization-scoped tenancy

Tokens, usage quotas, billing, and the screening audit log belong to an organization, and every dashboard query is scoped to the caller's organization membership. Team plans have owner and member roles; invitations are single-use hashed tokens that expire after seven days.

OAuth 2.1 for MCP clients

AI clients such as Claude and ChatGPT can connect to the MCP server through OAuth 2.1 with PKCE and rotating refresh tokens instead of a pasted API key. Each grant is scoped to one organization and can be disconnected from the Tokens page at any time.

Rate limits on every surface

Authenticated screening calls are burst-limited per organization (120 per minute by default) on top of the monthly quota; the dashboard search is limited per user, and the free public search and OAuth client registration are limited per client IP.

What happens to the values you screen

Screening calls are audit-logged for you

Each authenticated screening, VPN, or geolocation call writes one record — the endpoint, the screened value, the list, the verdict, and a timestamp — to your organization's audit log, visible in the dashboard. It exists so you can evidence that a check happened; it is never shared across organizations.

The free search stores nothing

The public SDN search on this site and its API endpoint are not metered and not logged: searched values are not written anywhere. They are rate-limited per IP instead.

Screening data is public government data

The lists CompliAPI screens against are official publications — OFAC, EU, UK, French, Japanese, and Israeli sanctions lists and public crime-intelligence sources — ingested directly from their publishers. The screening dataset contains no customer data, and every match links to the official source record.

Some lookups are forwarded to a specialist provider

VPN detection and geolocation send the IP address to ipinfo; PEP screening sends the queried name to OpenSanctions; screening an ENS name resolves it through Infura. Only the value needed for that lookup is forwarded, and each provider is listed in the subprocessors section below.

Retention and self-serve deletion

Audit records are kept for as long as your organization account exists. You can delete your account yourself from the dashboard's Account page: after re-entering your password, the account, its organization, API keys, usage history, and screening audit log are permanently removed and any subscription is cancelled immediately, with a confirmation email as the receipt. Personal information in backups and logs is retained no longer than three months past deletion, per the privacy policy.

Telemetry and analytics

Screened values never enter telemetry

Application tracing (Pydantic Logfire) deliberately drops request arguments, so the addresses, emails, and IDs you screen do not appear in traces or logs. Database spans record statements only, never bound parameters, and outbound calls to third-party providers are not traced at all.

Minimal product analytics

The backend emits a single server-side analytics event, on signup, carrying the account email and name so the team can welcome new users. The dashboard and marketing site use Google Tag Manager for page analytics with low-cardinality event labels only — never searched values or other user-entered data.

Availability and data freshness

Continuous list ingestion

OFAC's publication stream is polled every 15 minutes and the SDN and Consolidated lists are re-synchronized whenever a new publication appears; the other lists refresh on daily or weekly schedules. The current refresh countdown and per-list entity counts are public on the homepage and data-sources pages.

Delistings are reconciled, not deleted

When an entity leaves a list it is marked removed rather than erased, screening stops matching it, and it appears on the public delisted page — so you can see exactly what changed and when.

No silent failures on ingestion

Each list is ingested in isolation so one publisher's outage cannot stall the others, every ingestion step is idempotent and replays safely after a crash, and a crawl that returns far fewer entities than expected is rejected rather than allowed to mass-delist.

Payments

Card data is handled by Stripe

Subscriptions are sold through Stripe Checkout and Payment Links, so card numbers are entered on Stripe's pages and stored by Stripe. CompliAPI's servers receive only signature-verified webhook events and never see payment card details.

Pay-per-request needs no account

x402 payments are USDC transfers on Base, verified before a request is served and settled only after it succeeds — a failed request is never charged. Anonymous paid calls are logged with the payment reference and no account identity.

Subprocessors

Third parties that process customer or end-user data on CompliAPI's behalf, and exactly what each one receives. Providers that never see customer data (documentation hosting, the changelog feed) are not listed.

What we don't offer yet

Listed so you do not have to ask. If one of these blocks your procurement, say so on the contact page — it shapes what gets built next.

Third-party certifications

CompliAPI does not currently hold SOC 2, ISO 27001, or similar third-party attestations, and no independent penetration test report is available. The controls on this page are self-described and open to verification on request.

Single sign-on and two-factor authentication

Dashboard sign-in is email and password only. SAML or OIDC single sign-on and two-factor authentication are not offered yet. OAuth 2.1 is available for MCP client connections.

Public status page and uptime SLA

There is no public status page and no contractual uptime commitment on self-serve plans. The API's health endpoint is public at api.compliapi.com/health, and the data refresh schedule is shown live on the homepage.