Book a demo
Security

Every request, checked every time.

A compliance platform holds your most sensitive operational data, so CompliLens checks who you are, what your role allows and which organisation a record belongs to on every single request. Watch three requests go through.

Book a demo Watch the tour
Inside one request1 of 3
PATCH/policies/POL-012

    CompliLens is built and run by CodeLogicX, certified to ISO/IEC 27001:2022 for information security and ISO 9001:2015 for quality management.

    ISO/IEC 27001:2022ISO 9001:2015
    Data protection

    Every kind of data, protected its own way

    Not one lock for everything. Each kind of data gets the protection that fits it, and a clear answer to who can see it.

    Passwords

    Hashed with bcrypt before they are stored. Never kept or shown in plain text.

    Who can see itOnly the person who set it
    Sessions

    Access tokens expire after 15 minutes. Refresh tokens are hashed and revoked on sign-out.

    Who can see itThe signed-in user
    Connector credentials

    Encrypted with AES-256-GCM, used only during a sync and never sent back to the browser.

    Who can see itNo one, once saved
    Evidence and documents

    Stored privately. Every download link is signed and expires after an hour.

    Who can see itYour organisation, by role
    Trust Center links

    A random link with an optional hashed passcode, an expiry and one-click revoke. Visitors see the sections you choose to publish.

    Who can see itThe people you send it to
    Restricted data

    Records in restricted data categories are excluded before the AI drafts an answer or replies.

    Who can see itNever the AI
    Least privilege

    We ask your systems for as little as possible

    Connectors read settings and results. They do not change anything in your cloud, code or identity provider, and you can disconnect one at any time.

    • Read-only access wherever the platform offers it
    • Credentials encrypted the moment you save them
    • Every finding reviewed by a person before it becomes an NCR
    See every connector
    AWSAssumes a read-only role in your account, protected by an external ID.
    Read-only
    AzureAn app registration with reader access only.
    Read-only
    Google CloudA service account with viewer roles.
    Read-only
    GitHubInstalled as a GitHub App, so you choose the repositories.
    Read-only
    OktaA read-only API token.
    Read-only
    Microsoft IntuneA Microsoft Graph app that reads device compliance.
    Read-only
    Shared responsibility

    What we take care of, and what you decide

    CompliLens takes care of
    Keeping every organisation's data separate
    Enforcing roles on the server, on every request
    Encrypting connector credentials
    Expiring download links and sessions
    Keeping version history and timestamps
    AI guardrails, spend cap and kill switch
    You decide
    Who gets which of the seven roles
    Which connectors you add, and their scope
    Who receives a Trust Center link, and for how long
    Which data categories are restricted
    Whether AI features are switched on
    Reviewing access every quarter, in Access Reviews

    See exactly what each role can do on the By role page

    Recoverable by design

    Built so mistakes can be undone and history cannot

    Security is also about what happens after someone gets it wrong.

    01

    Soft deletes

    Most records are archived, not destroyed, so a mistaken delete can be undone.

    02

    Versions

    Every policy edit is a new version you can compare and restore.

    03

    Locked records

    Finalised management reviews cannot be edited. Their minutes stay as they were signed.

    04

    Timestamps

    Acknowledgements, training, uploads and decisions record who did what, and when.

    Questions

    Security, answered

    Can someone get round a permission by changing the request?

    No. Roles are checked on the server for every request, and unknown fields are rejected. Hiding a button is only a convenience; the server is what says no.

    What happens when someone leaves?

    Deactivate their account. Their access token expires within 15 minutes and their refresh token is revoked, and Access Reviews help you confirm nothing was missed.

    Can we switch the AI off?

    Yes. An administrator can turn AI features off entirely, and a monthly spend cap applies when they are on. The assistant is read-only either way.

    How do we report a security concern?

    Write to cx.sales@codelogicx.com with the details and we route it to the security team. Please do not include sensitive data in the first message.

    What do Trust Center visitors see?

    The sections you choose to publish: certifications, practice coverage by area, sub-processors with their DPA status, documents and your FAQ, all drawn from your live program. Detailed audit evidence goes to your auditor through Evidence Requests rather than a public link.