Home / Security and data protection
Security and data protection
Your compliance documentation describes where your company is vulnerable. Here you can see how Complass protects this data, who may do what, and how you stay in control yourself.
Five layers between the internet and your data
- 1
Encrypted connection and security headers
The portal is only reachable via HTTPS, and browsers remember this for a year (HSTS). A strict content security policy only allows scripts, styles and fonts from our own server, and the portal cannot be embedded in other websites.
- 2
Sign-in with password and MFA
Everyone signs in with a password and a code from their authenticator app. Two-factor sign-in is mandatory for all users, including our own administrators.
- 3
Roles and granular permissions
Administrator, editor or read-only, optionally limited to individual projects with “read” or “edit”. In addition, your administrators set no access, read or write per person and area (framework, module, menu item), plus special rights such as export, delete or approve. Changes take effect immediately and are logged.
- 4
Strict tenant separation
On every access, the server checks whether the project belongs to your company. Other companies’ projects simply do not exist from the portal’s point of view: the answer is “not found”.
- 5
Encrypted evidence files
Uploaded evidence is encrypted with a separate key per customer and stored outside the publicly accessible directory. Only people who may see the project can download it.
Our measures in detail
Sign-in and access
The server decides on every request who may enter and what they may do.
- Mandatory MFA
- Passkeys
- Sign-in with company account (SSO)
- Passwords with Argon2id
- Progressive account lockout
- IP rate limit and IP block
- Notice for a new device
- Session timeout
- Renewed confirmation before sensitive actions
- Roles and granular permissions
- Role profiles
- Four-eyes principle
- Tenant separation
- Supplier access
Show all measures in this area (14)
Mandatory MFA
Password and authenticator app code – or a passkey, which covers both factors – for everyone, including our administrators.
Passkeys
Sign in with fingerprint, Face ID, Windows Hello or a security key. A passkey covers both factors; password and authenticator app remain as a fallback.
Sign-in with company account (SSO)
Sign-in via your identity provider (OpenID Connect with PKCE), e.g. Microsoft Entra ID, Google Workspace, Okta or Keycloak. Your administrators can make SSO mandatory for your company.
Passwords with Argon2id
At least 12 characters, stored only as an Argon2id hash.
Progressive account lockout
Locked after repeated failed attempts, longer with further attempts: 15 minutes, 1 hour, 24 hours.
IP rate limit and IP block
Sign-in attempts per IP address are limited; on attack patterns, the address is blocked and operations are alerted.
Notice for a new device
When someone signs in from a new device, the person receives an email.
Session timeout
Sign-out after 30 minutes of inactivity, after 10 hours at the latest (default; per company 10–60 minutes and 4–12 hours).
Renewed confirmation before sensitive actions
For particularly sensitive actions, Complass requires a fresh confirmation with an app code or passkey ("step-up"), even within an active session.
Roles and granular permissions
No access, read or write per person and area, plus special rights, optionally time-limited.
Role profiles
Ready-made role profiles such as “Auditor extern” (external auditor) can be adopted and adjusted to your company by your administrators.
Four-eyes principle
Your administrators can configure a four-eyes principle for risk acceptances and document approvals. Interventions by Complass in your data (e.g. resetting password and MFA, changing an email address, permanently deleting a project) always require approval by a second person at Complass first.
Tenant separation
Every query is limited to your company; other objects are “not found”.
Supplier access
Suppliers only see the questionnaires and evidence assigned to them; the separation is tested automatically.
Who may do what?
Roles define what someone may do in principle. In addition, you can limit editors and readers to individual projects and set “read” or “edit” per project, never more than the role allows.
Show the table of roles and permissions
| Role | View projects | Edit content | Approve documents | Create projects | Manage team | Export | Delete projects |
|---|---|---|---|---|---|---|---|
| Administrator | all | yes | yes | yes | yes | yes | yes1 |
| Editor | all or selected | yes2 | no | yes3 | no | yes | no |
| Read-only | all or selected | no | no | no | no | yes | no |
| Auditor“read-only” with expiry date | selected, until the expiry date | no | no | no | no | yes | no |
| Complass consultantonly with your approval | all, while approved | yes | no | no | no | yes | no |
- Into the recycle bin, restorable for 30 days; only after typing the project name.
- In all projects or only in those set to “edit”.
- Only with access to all projects.
Editing requires a valid licence; after the licence ends, viewing and exporting remain possible. The last administrator of a company cannot be downgraded, so your team is never left without anyone to manage it.
The table shows the role defaults. Under “Permissions”, your administrators adjust rights per person at a granular level: per area (each framework, each module, each menu item) no access, read or write, plus special rights such as export (also per area), delete, approve documents, submit notification stages, import assets, invite people and manage permissions, optionally time-limited and via role profiles. The strictest rule always applies; read-only never writes. Menu items without permission are hidden, and the server rejects direct requests. Individual people can also be invited to exactly one object (e.g. a task or a document) to comment or co-edit without receiving further rights. You export the filtered permission matrix as evidence (Excel, CSV, PDF).
No insight by admins without your approval
In the user interface, Complass administrators only see administrative data such as company, booked modules and number of users. Insight into your content is only possible with your explicit, time-limited approval.
- Assets, incidents, vulnerabilities, tasks
- Projects only with consultant approval
- Emergency access only with your permission
- Support attachments only when approved
- Support session only with approval
- Visible and can be ended at any time
- Separate roles at Complass
Show all measures in this area (7)
Assets, incidents, vulnerabilities, tasks
Not accessible to Complass administrators in the user interface.
Projects only with consultant approval
Our consultants only see projects, documents and evidence if your administrator grants consultant access. Every session in which a consultant opens a project is recorded in your log with the kind of access.
Emergency access only with your permission
Only if you have allowed it in advance, with a reason and approval by a second person, for at most 60 minutes, read only, logged and with an immediate email to your administrators.
Support attachments only when approved
We only see support ticket attachments once your administrator has approved the ticket.
Support session only with approval
The person concerned approves the session, limited to 30, 60 or 120 minutes, read-only by default and without files or export. Write access additionally requires your administrator’s consent.
Visible and can be ended at any time
A banner shows “support session active” and you can end it at any time. Every page view is logged, and Complass additionally needs MFA for the session.
Separate roles at Complass
Roles are separated internally, e.g. engineering, sales and finance: staff only see what they need for their task.
Encryption
In transit and at rest.
- Data in transit
- Evidence files per customer
- MFA secrets and codes
Show all measures in this area (3)
Data in transit
HTTPS only, HSTS for one year including subdomains.
Evidence files per customer
Encrypted with a separate key per customer (XChaCha20-Poly1305), outside the public directory.
MFA secrets and codes
MFA secrets encrypted, invitation links and recovery codes stored only as HMAC.
Encrypted backups
A backup is only as good as its protection. That is why even someone with access to the server cannot read the database backups.
- Daily
- Encrypted with a public key
- Private key not on the server
- Evidence files stay encrypted
- Tampering is detected
- Up to 60 days and targeted restore
- Copy outside the server
Show all measures in this area (7)
Daily
Daily backup of the database and all evidence files.
Encrypted with a public key
The database backup is encrypted with libsodium (XChaCha20-Poly1305) for a public key.
Private key not on the server
We keep the private key for decryption offline only.
Evidence files stay encrypted
Evidence files are backed up in their encrypted form (key per customer).
Tampering is detected
Altered or damaged backups are detected on restore and are not applied.
Up to 60 days and targeted restore
The last 30 daily backups stay on the server; outside the server there are also daily states that cannot be deleted from the server, and a monthly offline copy. Every backup is deleted or overwritten after 60 days at the latest; individual projects can be restored selectively as a copy.
Copy outside the server
An encrypted copy of every backup is also kept outside the server in a data centre in Germany.
Hosting and operations
Where Complass runs and how we keep an eye on operations.
- Hosted in Germany
- Operations monitoring
- Daily operations report
- Availability checkable from outside
- Only the entry point is public
Show all measures in this area (5)
Hosted in Germany
At Hetzner Online GmbH in data centres in Germany, with a data processing agreement.
Operations monitoring
Backups, cron jobs, storage, vulnerability data, email delivery, server errors and response times are checked continuously; Complass is alerted automatically if anything is abnormal.
Daily operations report
Complass receives a daily report on the state of operations, without customer content.
Availability checkable from outside
A status address without customer data allows availability to be monitored from outside; external monitoring is being set up.
Only the entry point is public
Database, evidence, backups and program code are blocked from the web.
Application security
Protection against typical attacks on web applications.
- Content security policy
- Security headers and CSRF protection
- Upload checks
- Safe XML processing
- Network captures only in the browser
- Automatic security scans
- OWASP ASVS 5.0
Show all measures in this area (7)
Content security policy
Only scripts, styles and fonts from our own server, no inline scripts, no embedding in other sites.
Security headers and CSRF protection
Security headers on every response, CSRF token for every change.
Upload checks
Uploaded files are checked by extension and actual content; only permitted types.
Safe XML processing
XML imports (e.g. Nmap, scanners, Excel) without loading external resources and without resolving external entities.
Network captures only in the browser
PCAP files are analysed in the browser and not uploaded.
Automatic security scans
With every change to the code: static code analysis, a search for accidentally committed credentials, a check of all third-party components for known vulnerabilities, a software bill of materials (SBOM) and a dynamic scan of the running application.
OWASP ASVS 5.0
OWASP ASVS 5.0: Level 1 98 % · Level 2 93 % · Level 3 85 % (self-assessment, as of 21.10.2026). One justified exception, shown openly.
All changes traceable
For your audit evidence: who changed what and when.
- Change history per object
- Versions with approval
- Comment history
- Audit export
- Customer audit log
- Tamper-evident audit log
Show all measures in this area (6)
Change history per object
Who, when, old and new value, e.g. on catalogue entries, tasks and topic blocks.
Versions with approval
Earlier versions of documents with approval (name, date) and versions of evidence files remain available.
Comment history
Edited comments keep their earlier versions; retracted and hidden comments are preserved.
Audit export
An encrypted package for internal and external audits: projects, documents, evidence, registers and log, only within the read rights of the person who requests it. They receive the download link by email. A manifest with checksums shows that the package is unchanged; you verify it in the portal.
Customer audit log
Sign-ins, exports, permission changes, deletions and other important actions, filterable and exportable for your administrators.
Tamper-evident audit log
Every entry in your customer audit log and in the security events is linked to the previous one via a hash chain (HMAC-SHA-256); changes or deletions become visible on verification. You see the verification status (last checked, check value) in your customer audit log and in the export.
Data protection and control
Your data belongs to you.
- No advertising trackers
- Retention periods
- Export at any time, no lock-in
- Switching provider at no charge
- Read access after the contract ends
- Data deletion on request
Show all measures in this area (6)
No advertising trackers
No tracking or analytics tools and no external fonts or scripts in the customer area; visitor statistics without cookies on the public website (Plausible, EU); only strictly necessary cookies: the session and, if you choose a language, your language.
Retention periods
IP addresses in the log are shortened after 90 days, log entries deleted after 24 months, prospect enquiries after 12 months.
Export at any time, no lock-in
Documents, tables, reports and the compliance package with all evidence files exportable at any time.
Switching provider at no charge
Switch to another provider or to your own system with fixed time frames and an export of your company’s data in open formats. The page “Switching provider and data export” describes the process and formats.
Read access after the contract ends
After the contract ends, your content remains readable and exportable; only editing is locked.
Data deletion on request
In the portal: export first, then confirmation with password, MFA, company name and email, 7-day waiting period, deletion confirmation as PDF.
Vulnerability data without data leaving
Matching against public vulnerability data takes place on our server.
- Mirror of public sources
- No customer data sent out
Show all measures in this area (2)
Mirror of public sources
NVD, CISA KEV, EPSS and ENISA EUVD are downloaded to the server.
No customer data sent out
Information from your asset inventory is not sent to external services for matching.
Transparency
What we use, how we develop Complass further and how you can report security vulnerabilities to us.
- Sub-processors
- Support via your administrator
- Version history
- Report a vulnerability
- Content with AI support
Show all measures in this area (5)
Sub-processors
For the content you record in the portal, we use Hetzner Online GmbH (hosting). With the add-on “Alerting by SMS and voice”, sms77 io GmbH (seven.io) is added for the phone number and alert text.
Support via your administrator
Bugs, requests and questions reach us bundled via your administrator. You see status and replies in the ticket, up to “resolved in version …”. You never see other customers’ tickets, and vice versa.
Version history
What changes is listed per version under “What’s new”.
Report a vulnerability
Please send notices of security vulnerabilities to security@complass.de; contact also at /.well-known/security.txt.
Content with AI support
Content is created with the support of AI and checked against the original texts by our experts.
What happens if …?
Security shows in everyday situations. These cases happen in every company, and this is how Complass handles them.
… a password falls into the wrong hands?
Without the code from the authenticator app, nobody gets in. After 5 wrong passwords, password sign-in from that network is locked; after 5 wrong codes, the whole account is locked, first for 15 minutes, and for longer if it is locked again within 24 hours. This way nobody who only knows your email address can lock you out. The person and your administrators receive an email when a lock occurs. If someone signs in from a new device, the person is notified by email as well. Failed sign-ins appear in your audit log.
… someone leaves the company?
Your administrator deactivates the account under “Team and access”. All of this person’s open sessions end immediately, and signing in is no longer possible. The seat in your user quota becomes free again.
… someone leaves the browser open?
After 30 minutes without input the portal signs out automatically; after 10 hours at the latest a new sign-in with MFA is required. A company's administrators can choose 10 to 60 minutes and 4 to 12 hours. Everyone sees their active sessions and can sign out other devices.
… the phone with the app gets lost?
Use your recovery key to sign in once and set up a new app right away. Without the key, your administrator resets two-factor sign-in on request; your password stays, and previous sessions expire.
Show more cases (5)
… an auditor needs insight?
Create an account with the “read-only” role, limited to the project concerned and with an expiry date. After that date, signing in is no longer possible, without anyone having to remember it.
… Complass is to support you?
Our consultants only see your projects once your administrator grants consultant access, each time for at most 90 days. Every session in which a consultant opens a project is recorded in your audit log, and access can be revoked with one click. Emergency access exists only if your company has allowed it in advance: with a renewed sign-in, approval by a second person from our team, for at most 60 minutes and read only; your administrators are notified by email immediately. If our team resets a person's account (password and two-factor sign-in), changes their email address or permanently deletes a project, this only happens after approval by a second person from our team, and your administrators receive an email about it. The person receives the link to set up their account again by email; our team never sees it. This also applies to specialists that Complass engages for individual assignments: they work on behalf of Complass and only through the consultant access you have granted.
… Complass needs to see your view to help?
You stay in control of support access: our support only sees your view with your approval, which you grant yourself in the ticket or under “My account”. It is time-limited (30 minutes to 2 hours), read-only by default, without files and without export, and can be ended at any time with one click. Your account page, password and two-factor sign-in, team, permissions and subscription remain locked. You and your administrators are notified when a session starts, and every page view is recorded in your audit log. Even with write access, support cannot give approvals, releases, acceptances, risk acceptances or acknowledgements; anything it creates or changes is marked “created in support by …” in the history.
… a project is deleted by mistake?
Only administrators (or people your administrators grant the “delete” right) can delete, and only after typing the project name and confirming with the current app code or passkey. The project then stays in the recycle bin for 30 days and can be restored with one click. Earlier versions of documents and checklists are kept, and there is a daily backup on top.
… the licence ends?
Your projects remain readable and exportable; only editing is locked. The compliance package as a ZIP file contains documents, tables, reports and all evidence files with checksums.
What we deliberately don’t do
- No advertising trackers, no analytics in the customer area
- No selling or passing on of your data
- No training of AI with your data
- No third-party remote control tools
Details on the processing of personal data can be found in the privacy policy.
Technical details for your IT
For IT management and information security officers: the measures in detail.
Sign-in and passwords
- Passwords with at least 12 characters; rejected are, among others, passwords that contain the email address, the person’s own name or the company name, have too simple a structure, are among the most common passwords or have appeared in known data breaches.
- For the data breach check only the first 5 characters of a hash of the password leave the server (k-anonymity); the password itself is never transmitted.
- Uniform error message and equalised response time, so it cannot be determined whether an email address is registered.
- Progressive lockout after 5 failed attempts (15 min, 1 h, 1 day; the counter expires after 24 hours without a failed attempt): wrong passwords only lock password sign-in from the network they come from, wrong codes lock the whole account. In addition, a limit of 30 sign-in attempts per IP address within 15 minutes applies, also to passkeys.
- Accounts are only created via invitation links: valid for 72 hours, single use, even with simultaneous requests.
- Outgoing connections, for example to the provider of sign-in with company account or to vendors’ security advisories, only go to public addresses via https; redirects are checked one by one. Internal networks of the data centre cannot be reached this way.
Protection against attacks on sign-in
- Progressive lockout: after 5 wrong passwords, password sign-in from that network is locked for 15 minutes; after 5 wrong codes, the whole account is locked; if a lock recurs within 24 hours, it is extended step by step (15 min, 1 h, 1 day). A successful sign-in resets the counter. Wrong passwords and codes also count in an open session; after 5 failed attempts the session ends.
- Limit per connection: at most 30 sign-in attempts per IP address within 15 minutes; after repeated failed attempts, sign-in responds with a delay (up to 2 seconds). Many failed attempts across many different addresses from one connection temporarily block it from signing in.
- Same message and same response time for an unknown address, a wrong password and a locked account: from the outside it cannot be determined whether an account exists or is locked.
- Notification: when an account is locked, the person and your company’s administrators receive an email; administrators can lift the lockout. When someone signs in from a previously unknown device, the person receives an email (can be switched off under “My account”). A known device is recognised by a signed device cookie, even if its IP address changes, otherwise roughly by browser, operating system and network range, without location services.
- Alerting of operations: failed attempts, lockouts, IP blocks and requests to typical attack targets are recorded as security events. For accumulations, blocked connections and events on our administrators’ accounts, our operations team is alerted by email immediately; it also receives a daily report.
- Your administrators see the security events on your company’s accounts (failed sign-ins, lockouts, new devices) with filters and export.
Two-factor authentication (MFA)
- TOTP per RFC 6238 (6 digits, 30 seconds), compatible with common authenticator apps. Each code is valid only once (replay protection).
- The setup QR code is generated in the browser; the secret is not sent to any external service.
- One recovery key (28 characters), usable once, followed by a mandatory new app setup, can be regenerated at any time.
- There is no access without MFA; setup is enforced at the first sign-in.
Sessions and protection against attacks
- Session cookie with __Host- prefix, Secure, HttpOnly and SameSite=Strict; new session ID after each sign-in stage.
- Sign-out after 30 minutes of inactivity, after 10 hours at the latest (default; per company 10–60 minutes and 4–12 hours).
- When the password or MFA device is changed, all other sessions of the person end; on deactivation, all of them.
- CSRF token for every change.
- Content security policy without inline scripts and without external sources (default-src 'self', frame-ancestors 'none', object-src 'none'), plus X-Content-Type-Options, Referrer-Policy, Permissions-Policy, Cross-Origin-Opener-Policy and Cache-Control: no-store.
Encryption
- Data in transit: HTTPS only, HSTS for one year including subdomains.
- Evidence files: libsodium secretstream (XChaCha20-Poly1305) in 64 KiB blocks, key per customer derived from the master key via KDF. Stored under random names outside the web root (directories 0700, files 0600).
- MFA secrets: encrypted with libsodium secretbox (XSalsa20-Poly1305).
- Passwords: stored only as an Argon2id hash; older hashes are renewed automatically at the next sign-in. Invitation links and recovery codes: stored only as HMAC-SHA-256.
- Backup of evidence files: contains the files in their encrypted form.
- Database backup: hybrid encryption (libsodium: file key per backup, content with XChaCha20-Poly1305, file key sealed to the public backup key). The private key is not stored on the server.
Evidence files
- Only certain file types are allowed; both extension and actual content are checked.
- Retrieval only with access to the project or task: as a download or, for PDFs, images and text files, as a view in the browser. Both always in an isolated context (sandbox) without scripts.
- The same file name creates a new version; earlier versions remain available. Deleted files are permanently removed after 30 days.
Backup and recovery
- Daily backup of the database (consistent, compressed and encrypted copy) and of the evidence files; the last 30 backups are kept.
- Recycle bin for all entries (projects, risks, incidents, tasks, assets, evidence files and more): restorable for 30 days, then permanently deleted.
- Earlier versions: the last 100 per document (approved versions permanently), the last 50 states per checklist.
- Own key per customer in the backups: it is destroyed when the customer is deleted; the data then become unreadable in most backups at once and in all of them when they expire.
- Individual projects can be restored from a backup as a copy next to the current state, without overwriting existing data.
Access by Complass
- Consultants only see customer projects with approval from one of the customer’s administrators; consultant access is recorded in the customer audit log (consultant access per session and project, emergency access on every project call with its number).
- Emergency access only if the customer has allowed it in advance, with a written reason, a renewed sign-in and approval by a second person, for at most 60 minutes, read only, recorded in the customer audit log and with an immediate email to the customer’s administrators.
- Support sessions only with approval from the person concerned, time-limited, read-only by default, started with our administrator’s MFA code in a separate session (your session is never taken over), and can be ended by you at any time; every page view is recorded in the customer audit log.
- Support actions by our administrators, such as resetting password and MFA or ending sessions, also appear in your audit log.
Operations
- Hosted by Hetzner Online GmbH on servers in Germany.
- Only the portal’s entry point is publicly reachable; database, evidence files, backups and program code are blocked from the web.
- Operations monitoring: availability, backups, cron jobs, storage, vulnerability data, email delivery, server errors, response time and PHP are checked continuously; alerts go to Complass by email. No customer content in the monitoring.
Frequently asked questions on security
Who can see my data?
The people in your company to whom your administrators give access, within their permissions. In the user interface, Complass only sees administrative data; content only with your consultant approval, in a support session you approved, or through logged emergency access if you have allowed it in advance.
Can Complass technically access the data?
As the operator, we manage the server and the keys for encrypting the evidence files. Access outside the user interface is governed by the data processing agreement and limited to operations.
What happens in the event of a security incident at Complass?
We inform affected customers without delay. Personal data breaches are reported in accordance with the GDPR, as a processor first to you as the controller.
Is Complass certified?
No. On this page we describe which measures are implemented; we are happy to answer your IT security team’s questions in detail.
Questions from your IT security team?
We are happy to answer your questions about the security of Complass, including during a demo.
How we assess against OWASP ASVS 5.0
Or by e-mail to info@complass.eu.