Built to hold the evidence auditors ask for.
A compliance platform ends up holding some of your most sensitive information. Here is how RelayComply protects it. Found a vulnerability? Email [email protected].
Your data
Encrypted credentials
Integration secrets are encrypted with AES-256-GCM, with a key derived from a server-side secret, and decrypted only to run a check.
Least-privilege integrations
Integrations request the access their checks need, read-only wherever the provider allows it. Fixes are suggested; nothing changes in your accounts without an explicit action.
Tenant isolation
Every API request is scoped to the organisation you are signed in to, enforced on the server.
Access
Passwordless sign-in
Sign in with a one-time code or magic link sent to your work email, or with Google, Microsoft or GitHub.
Roles and permissions
Built-in owner, admin, auditor, employee and contractor roles, plus custom roles with per-resource permissions.
Scoped API keys
API access uses keys tied to your organisation that you can create and revoke from settings.
Accountability
Audit log
Changes made through the API are recorded with who made them and when.
Approval trails
Policies, ISMS documents and the Statement of Applicability keep their approval and version history.
Self-hosting
RelayComply is built on open-source software and can run on infrastructure you control.
Take the baton.
Start with the framework your customers ask for. RelayComply builds the policies, controls and evidence tasks around it in minutes.