> For the complete documentation index, see [llms.txt](https://docs.complycube.com/documentation/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.complycube.com/documentation/trust-and-compliance/compliance.md).

# Compliance

### Overview

ComplyCube helps regulated businesses meet identity verification, KYC, KYB, AML, and fraud prevention requirements through one platform.

This page outlines ComplyCube compliance certifications, security controls, data processing practices, and privacy coverage.

{% hint style="info" %}
For current documentation and evidence, visit the [ComplyCube Trust Center](https://trust.complycube.com).
{% endhint %}

### Compliance certifications and frameworks

ComplyCube maintains and supports the following certifications, standards, and privacy frameworks:

<table data-header-hidden="false" data-header-sticky data-search="false"><thead><tr><th>Standard or framework</th><th>Coverage</th></tr></thead><tbody><tr><td><strong>ISO 27001:2022</strong></td><td>Information security management.</td></tr><tr><td><strong>ISO 9001:2015</strong></td><td>Quality management systems.</td></tr><tr><td><strong>UK Cyber Essentials</strong></td><td>Baseline cybersecurity controls.</td></tr><tr><td><strong>UK DIATF</strong></td><td>UK Digital Identity and Attributes Trust Framework alignment.</td></tr><tr><td><strong>ISO 30107-3</strong></td><td>Presentation attack detection testing.</td></tr><tr><td><strong>ACCS 4:2020</strong></td><td>Technical requirements for age check systems.</td></tr><tr><td><strong>GDPR</strong></td><td>EU data protection and privacy requirements.</td></tr><tr><td><strong>CCPA</strong></td><td>California privacy requirements.</td></tr></tbody></table>

### Security control areas

ComplyCube publishes controls across the following domains:

| Control area                     | Coverage                                                                                          |
| -------------------------------- | ------------------------------------------------------------------------------------------------- |
| **Infrastructure security**      | Privileged access restrictions, MFA, secure authentication, and network access controls.          |
| **Organizational security**      | Asset disposal, anti-malware, confidentiality agreements, password policy, and employee controls. |
| **Product security**             | Encryption at rest, control self-assessments, and penetration testing.                            |
| **Internal security procedures** | BC/DR planning, secure development lifecycle, whistleblower processes, and governance oversight.  |
| **Data and privacy**             | Data classification, retention, and customer data deletion procedures.                            |

### Data processing and privacy

ComplyCube applies the following data handling practices across verification and compliance workflows:

| Area                         | How ComplyCube handles it                                                                                                                                                                                |
| ---------------------------- | -------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------------- |
| **Data minimization**        | Only data needed for the configured verification flow is collected and processed.                                                                                                                        |
| **Processing and residency** | Processing and storage follow the region selected for your account and use case. For regional handling and storage options, see [Data Residency](/documentation/trust-and-compliance/data-residency.md). |
| **Retention**                | Retention periods can be configured, with deletion workflows to support regulatory and business requirements.                                                                                            |
| **Subprocessors**            | Subprocessors are documented and bound by appropriate security and data protection obligations.                                                                                                          |
| **Data subject requests**    | Privacy requests are handled through documented processes, including export and deletion workflows where applicable.                                                                                     |

### Audit trail

Every action and verification produces a detailed evidence trail that helps organizations understand how decisions are made and demonstrate compliance when needed.

Depending on the verification type, the available evidence may include:

* Verification events and processing timeline.
* Identity document images and extracted data.
* Biometric verification results, including liveness and face match outcomes.
* AML screening findings and verification outcomes.
* Reviewer actions and decision history, where applicable.
* Downloadable reports and supporting evidence.

All evidence is securely retained and governed by configurable access permissions and retention settings, helping organizations meet internal governance and regulatory requirements.

### Security measures

ComplyCube protects customer data through multiple layers of technical, operational, and organizational security controls.

Depending on your deployment and configuration, these safeguards include:

* Encryption for data in transit and at rest.
* Secure key management and tightly controlled access to sensitive systems.
* Signed webhooks, IP allowlists, and network security controls.
* Continuous vulnerability assessments and regular penetration testing.
* Business continuity, disaster recovery, and incident response processes.

Together, these measures help protect sensitive information, maintain platform resilience, and support industry security and compliance requirements.


---

# Agent Instructions
This documentation is published with GitBook. GitBook is the documentation platform designed so that both humans and AI agents can read, navigate, and reason over technical content effectively. Learn more at gitbook.com.

## Querying This Documentation
If you need additional information that is not directly available in this page, you can query the documentation dynamically by asking a question.

Perform an HTTP GET request on the current page URL with the `ask` query parameter, and the optional `goal` query parameter:

```
GET https://docs.complycube.com/documentation/trust-and-compliance/compliance.md?ask=<question>&goal=<endgoal>
```

`ask` is the immediate question: it should be specific, self-contained, and written in natural language.
`goal` is optional and describes the broader end goal you are ultimately trying to accomplish on behalf of the user. GitBook uses it to tailor the answer towards what is most useful for that goal.

The response will contain a direct answer to the question and relevant excerpts and sources from the documentation.

Use this mechanism when the answer is not explicitly present in the current page, you need clarification or additional context, or you want to retrieve related documentation sections.