Security at Compyl — encrypted, monitored, and independently audited.
Scale your organization securely with Compyl, the GRC platform built by security practitioners. Data security, application security, and infrastructure security are designed in from day one, monitored continuously, and proven by an independently audited SOC 2 Type II.
Compyl encrypts all customer data and stores it in secure databases, with files encrypted in Microsoft Blob Storage, secrets and API keys held in Azure Key Vault, identity managed through Microsoft Identity and Authorization, and access restricted by secure private endpoints. The application runs on Microsoft Azure with a REST API microservices architecture, is continuously evaluated by leading third-party penetration testing partners, and every call to and from your environment is secured over HTTPS. Compyl backs it with an independently audited SOC 2 Type II report.
Three layers of security, built in
Compyl protects your data, your applications, and the infrastructure they run on — using the same security stack we help our customers govern.
Data Security
Compyl monitors customer environments and stores all data in secure databases, with encryption protecting every asset. We use tools like Azure Key Vault, Microsoft Identity, Microsoft Authorization, and secure private endpoints. All files uploaded to Compyl are encrypted and stored in Microsoft Blob Storage.
Application Security
Compyl partners with many of the world’s leading third-party penetration testing services. We constantly evaluate the source code, running applications, and deployed environments. API keys are stored in Azure Key Vault, the app is covered by unit and automation testing, and internal errors are logged in Microsoft Log Analytics.
Infrastructure Security
Compyl uses Azure Web Apps to host customer environments and leverages the full Azure security ecosystem — Key Vault, Blob Storage, Log Analytics, Virtual Networks, and Private Endpoints. The application is powered by a REST API microservices architecture, and every call to and from your environment is secured with HTTPS.
We run the same program we sell
Compyl was built by information security experts — so our own posture is held to the standard we help thousands of teams reach. We maintain an independently audited SOC 2 Type II and monitor our environments every day.
Monitoring thousands of environments daily
Rated a leader by the teams who use it
Security questions, answered
Yes. Compyl maintains a SOC 2 Type II report, independently audited against the AICPA Trust Services Criteria. Customers and prospects can request the report through our team.
All customer data is encrypted and stored in secure databases. Uploaded files are encrypted and stored in Microsoft Blob Storage, secrets and API keys are held in Azure Key Vault, identity and authorization run on Microsoft Identity, and access is restricted with secure private endpoints.
Compyl runs on Microsoft Azure using Azure Web Apps, and leverages Azure security products including Key Vault, Blob Storage, Log Analytics, Virtual Networks, and Private Endpoints. The application uses a REST API microservices architecture, and every call to and from a customer environment is secured over HTTPS.
Yes. Compyl partners with leading third-party penetration testing services and continuously evaluates source code, running applications, and deployed environments — backed by unit and automation testing, with centralized error logging in Microsoft Log Analytics.
If you’ve found a potential vulnerability, please reach out through our responsible disclosure process so our security team can investigate and respond.
