Security · evidence
Security you can verify
We test Complass ourselves, continuously and with documented results. What independent services measure from the outside, you can check yourself with one click.
As of 22.10.2026 · version 2.05.2
Measured by independent services
These results come from public test services, not from us. Each link shows that service’s current result.
-
Qualys SSL Labs A+
- Only TLS 1.2 and 1.3
- HSTS for one year, including subdomains
- Certificate valid, renewed automatically
-
Mozilla HTTP Observatory A+
- 12/12 tests
- Strict content security policy
- Protection against being embedded in other sites
- Secure cookies
-
security.txt per RFC 9116 present
- Fixed contact for security reports
- Valid until 28.09.2027
- German and English
The grades show our status as of 22.10.2026. The services measure publicly reachable properties of our website. They do not work on our behalf and do not award a seal.
Our own checks
We test ourselves, with our own tools and without outside consultants. We say this openly, because it means: we do not test once a year, but with every change.
-
OWASP ASVS 5.0 Level 1 to 3 · self-assessment
- 98 % Level 1
- 93 % Level 2
- 85 % Level 3
Each requirement assessed against the code and operations. We only call a level met once everything is implemented.
Justified exceptions (not counted as met)
-
Key length of third parties (V11.2.3, Level 2): RSA-2048 from identity providers and passkey devices – permitted under NIST SP 800-131A until the end of 2030.
Why?
Complass itself encrypts throughout with at least 128 bits of security (256-bit keys). Identity providers such as Microsoft or Google and many passkey devices, however, sign with RSA-2048 (112 bits). We accept these keys in line with NIST SP 800-131A until the end of 2030; from 2031 we require at least RSA-3072. If we rejected RSA-2048 today, signing in with SSO and passkeys would no longer be possible.
-
Automatic scans with every change
- Static code analysis
- Search for accidentally committed credentials
- All third-party components checked for known vulnerabilities
- Software bill of materials (SBOM)
- Dynamic scan of the running application
-
Review of every new feature before every release
- Permissions
- Tenant separation
- Input handling
10,000+ automated tests block every release if even one of them fails.
What is OWASP ASVS, and what do levels 1, 2 and 3 mean?
The standard
The Application Security Verification Standard (ASVS) is an open verification standard from the non-profit OWASP Foundation. In several hundred individual requirements it sets out what a secure web application must do: from sign-in, sessions and permissions to input handling, encryption and logging. The current version 5.0 was published in 2025.
The three levels
- Level 1
- Baseline protection against obvious attacks that are easy to exploit. The minimum for every application.
- Level 2
- The standard for applications with sensitive or business-critical data, such as personal data or information security records. Builds on level 1.
- Level 3
- The highest level, for especially critical systems. Builds on level 2.
Where we stand
OWASP ASVS 5.0: Level 1 98 % · Level 2 93 % · Level 3 85 % (self-assessment, as of 21.10.2026). One justified exception, shown openly. How we count
We have assessed every level 1 and level 2 requirement individually against the code and the operation of Complass, and recorded evidence for each requirement. We repeat the full assessment for every major version; with every release we re-check the requirements it affects.
What it is not
Not a certificate: OWASP does not issue certificates and does not test applications itself. Our statement is a self-assessment by Complass.
Customers and prospects receive the detailed mapping per requirement, with implementation, evidence and verification steps, in our security dossier after concluding a non-disclosure agreement. Write to us at info@complass.eu, subject “Sicherheitsdossier” (security dossier).
Results at a glance
We publish a short summary. We do not name individual findings publicly, so nobody can exploit them.
- No open critical findings – across all checks up to 22.10.2026
- Every check documented – with date, time and the state checked, even without a finding
- Hosted in Germany – servers of Hetzner Online GmbH
- Deletion reaches the backups too – own backup key per customer, destroyed with the deletion
Security notices
There are no published security notices at present. Report vulnerabilities to security@complass.de (see security.txt).
How we test
All statements on this page are based on our own checks or on public test services. Complass is not certified by an external body.
| Type of check | Who tests | Cadence |
|---|---|---|
| Assessment per OWASP ASVS 5.0 | Complass, self-assessment | Fully per major version, affected requirements per release |
| Static and dynamic scans | Complass, automated | With every change to the code |
| TLS, headers, security.txt | Public test services | After every release, always verifiable yourself |
Request the security report and the security dossier
For your vendor assessment: you receive the security report, with answers to the usual questions of a security questionnaire, from us without a non-disclosure agreement, issued to your company. For audits and deeper reviews there is also the security dossier with implementation, evidence and verification steps per requirement, after concluding a non-disclosure agreement. Write to us at info@complass.eu.
Or by email to info@complass.eu.
Found a security vulnerability? Write to security@complass.de. Notes on reporting are in our security.txt.