Your data security is foundational, not optional

Application Security

The Complia platform is built on Nuxt 4 with Nitro server, following modern security best practices at every layer:

• Content Security Policy (CSP): Strict CSP headers prevent XSS attacks by controlling which scripts, styles, and resources can be loaded
• Security headers: X-Frame-Options (DENY), X-Content-Type-Options (nosniff), Referrer-Policy, and Permissions-Policy headers on all responses
• Input validation: All user input is validated and sanitized server-side using Zod schema validation
• CSRF protection: SameSite cookie attributes and token-based protection against cross-site request forgery
• SQL injection prevention: Parameterized queries throughout -- no raw string concatenation in database operations
• Rate limiting: API endpoints are rate-limited to prevent abuse (e.g., 3 auth emails/hour, 5 login attempts/15 minutes)

Payment Security

Handling payments for regulated products requires the highest standards of security:

• PCI-DSS compliance: Payment data is handled in compliance with Payment Card Industry Data Security Standards
• Token encryption: Payment tokens are encrypted with dedicated encryption keys (NFR-SEC-003) and never stored in plaintext
• Processor isolation: Payment processing is delegated to PCI-certified processors -- Complia never stores raw card numbers
• Chargeback monitoring: Automated monitoring and dispute management to protect against fraudulent chargebacks

Infrastructure Security

• Private networking: Database and cache services are accessible only through private network interfaces, not exposed to the public internet
• Managed databases: PostgreSQL with automated backups, point-in-time recovery, and encrypted storage
• Environment isolation: Strict separation between development, staging, and production environments with independent databases and credentials
• SSL/TLS: All database and cache connections require SSL. Public endpoints use TLS 1.3
• Secrets management: Environment variables for all credentials -- no secrets in code, configuration files, or version control

Data Protection

• Automated backups: Daily database backups with cloud storage replication and verified restore procedures
• Data residency: All data is stored in US-based data centers
• Access controls: Role-based access control (RBAC) with distinct admin, sales, and fulfillment roles
• Data minimization: We collect and retain only the data necessary to provide the Service
• Right to erasure: Customer data can be exported and deleted upon request within 30 days

Operational Security

• Dependency scanning: Automated vulnerability scanning of all npm dependencies in CI/CD pipeline
• Static analysis: SAST tools scan for security vulnerabilities in application code
• Secret detection: Automated scanning to prevent accidental commit of credentials or API keys
• Migration safety: Database migrations are tested in isolated environments before production deployment, with mandatory rollback procedures
• Incident documentation: All production incidents are documented with root cause analysis and preventive measures

Reporting a Vulnerability

We take security seriously and appreciate responsible disclosure. If you discover a security vulnerability in the Complia platform, please report it to us:

• Email: security@complia.co
• Please include a detailed description of the vulnerability, steps to reproduce, and potential impact
• We will acknowledge receipt within 24 hours and provide a timeline for resolution
• We ask that you give us reasonable time to address the issue before public disclosure