Tenant separation is the design premise
Complyee is built as a multi-tenant service where separation between customers is enforced by the platform itself, not by careful use of the user interface. Each workspace has its own address, its own document store, its own settings, its own members and its own audit trail.
Every request is resolved to exactly one workspace before any data is read, and every data access is scoped to that workspace at the data layer. There is no view, endpoint or search path in the product that spans two customers.
Getting into a workspace
Access control is layered: a request has to arrive from an approved network, from an approved identity, on an approved email domain, before it can become a workspace session.
- Approved networks only
Each workspace can define the public IP ranges it is reachable from. Requests from anywhere else are refused — both at the edge, before they reach the application, and again inside the application when a session is established.
- No passwords, anywhere
Complyee has no password to phish, reuse or leak. Employees sign in either with a one-time code sent to their company mailbox, or with single sign-on through the company's own identity provider.
- Company email domains only
A workspace lists the email domains it accepts. Addresses outside those domains cannot receive a sign-in code and cannot become members, regardless of how the request is made.
- Single sign-on, optionally mandatory
Single sign-on can be enabled, and then required. When required, the email-code path is switched off entirely and refused on the server — so identity, multi-factor policy, conditional access and deprovisioning are governed solely by your identity provider. Attempts to use the disabled path are recorded.
- Roles, not shared logins
Members, workspace administrators and platform administrators are distinct roles held per user. Role changes are privileged operations performed server-side and written to the audit trail.
Your documents
Documents are uploaded by your workspace administrators and stored in a storage location dedicated to your workspace. Your content is never pooled with another customer's content, and the search index built from it is likewise dedicated to your workspace.
Documents are not published on public links. Opening or downloading a document goes through the application, which re-checks the member's session, role, workspace and network before issuing a short-lived, single-purpose grant for that one file. Deleting a document removes it from both the store and the search index.
Answers stay inside your material
Retrieval is restricted to your workspace's own document set — the assistant cannot reach another customer's material, and it cannot reach the open internet. A grounding setting controls how strictly answers must stay within the source documents, and answers carry references back to the document and page they came from, so any claim can be checked.
Your documents, questions and answers are not used to train models.
Keys and credentials
Service credentials live in an encrypted secret store managed outside the codebase. They are never committed to source control, never shipped to the browser and never rendered in the interface — only server-side code can read them, and only at the moment it needs them. Credentials can be rotated without changing application code.
Access between components follows least privilege: each credential is granted the narrowest role that lets it do its job, and nothing more.
Separation inside the AI platform
For workspaces running on the Complyee-operated cloud environment, separation is carried through to the AI layer: each workspace has its own storage bucket and its own search datastore, addressed by identifiers that are bound to the workspace record. A query issued in one workspace is physically incapable of reaching another workspace's datastore, because the datastore it targets is resolved from the authenticated workspace, never from anything the user supplies.
Bring your own cloud
Where your policy requires it, a workspace can run entirely inside your own Google Cloud project: your storage, your search index, your region, your service account. Complyee then holds only a scoped credential that you issue and can revoke at any time, and your documents and generated answers never leave your own tenancy.
Edge protection
All traffic is served over TLS through a global edge network that absorbs volumetric and denial-of-service traffic before it reaches the application. Per-workspace firewall rules at that edge drop requests from networks a customer has not approved, so unauthorised traffic is stopped upstream rather than at the application door.
Audit trail
Each workspace gets its own audit trail: sign-ins, denied sign-in attempts, questions asked, answers returned, documents uploaded, indexed and deleted, document downloads, document requests and their outcomes, role changes, member removals and settings changes.
The trail is written to your workspace's own storage and is readable by your administrators in the product, so your security function can review activity without depending on us to extract it.
Data location
New workspaces are placed in the EU by default, and the region is fixed for the lifetime of the workspace. Other regions can be selected at onboarding where your operations require it, and customers running in their own cloud project choose their region themselves.
Where we are on certifications
We would rather be plain about this than imply more than is true: Complyee is not currently SOC 2 or ISO 27001 certified, and we do not claim to be. What we do have is the set of controls described on this page, applied to every workspace by default rather than as paid add-ons, and a willingness to walk your security function through the specifics under NDA.
We are happy to complete security questionnaires, discuss a data processing agreement, and share our roadmap towards formal certification. If a certification is a hard requirement for you today, tell us early and we will say so honestly rather than let it surface late in a procurement process.
Reporting a vulnerability
If you believe you have found a security weakness in Complyee, please write to security@complyee.ai with enough detail for us to reproduce it. We acknowledge reports within two business days and will keep you updated until the issue is resolved. Please give us a reasonable window to fix an issue before disclosing it publicly, and do not access, alter or retain data that is not yours while investigating.