Your vendor review, answered on one page.
What compliance.tf runs on, how it protects your data, and who to ask, each with the document behind it.
- Personal data
- Name, email, username and server logs (Privacy Policy)
- Where it runs
- AWS, in us-east-1 (US) and eu-west-1 (Ireland)
- Encryption
- TLS 1.2+ in transit, AES-256 with AWS KMS at rest
- Sub-processors
- AWS, Plausible Analytics, Sprinto (DPA)
- Breach notice
- Within 72 hours for personal data
- Uptime
- 99.9% monthly for paid subscribers (SLA)
- Security contact
- mail@compliance.tf
Security practices
- Company
- compliance.tf by Betajob AS
- For
- You, reviewing compliance.tf as a vendor
- Last updated
- 25 March 2026
Trust Center and compliance
Trust Center
The compliance.tf Trust Center has the compliance and security documentation: the SOC 2 reports, the security controls, and downloadable resources including the ISMS Manual and the System Description.
Certifications and commitments
- SOC 2 Type II, available through the Trust Center.
- GDPR: see the Privacy Policy and the Data Processing Agreement.
- AWS Well-Architected Framework: Compliance.tf follows AWS best practices for security, reliability and operational excellence.
Architecture
Compliance.tf is built on a serverless architecture designed for security and resilience. There are no servers to patch, no operating systems to maintain, and no long-running processes that could be compromised.
Frontend
Static, served from Amazon S3 through the CloudFront CDN. No server-side rendering, so the attack surface stays small.
API
Runs on AWS Lambda. Each request executes in an isolated environment with no persistent state.
Data
Stored in Amazon DynamoDB, with encryption at rest enabled by default.
Authentication
Handled by AWS Cognito, with email and password or Google OAuth.
Regions
The infrastructure spans two AWS regions: us-east-1 (US) and eu-west-1 (Ireland).
Encryption
In transit
TLS 1.2 or higher for all connections. There are no unencrypted paths; HTTP requests redirect to HTTPS.
At rest
AES-256 encryption through AWS Key Management Service (KMS) for all stored data, including DynamoDB tables, S3 objects and CloudWatch logs.
API tokens
Hashed before storage. Tokens are never stored in plaintext.
Every change to a module is rule logic you can read and diff.
Modules from compliance.tf are not byte-for-byte copies of upstream code. Two kinds of change are applied at download time, by predefined logic, and what arrives is standard HCL your team reviews before deploying.
Module integrity
What changes at download time
- Compliance controls add the security configuration your chosen framework requires, for example SOC 2, PCI DSS or HIPAA.
- Operational rulesadd lifecycle blocks, remove provisioners or restrict instance types, based on your organization's configuration.
How it changes
The transformations follow predefined rule logic scoped to your authenticated organization. They are not ad-hoc manual edits. The delivered output is standard HCL that you can read, diff against upstream and review before deploying.
Least privilege, individual access, and a written plan when something goes wrong.
Every team member signs in with their own account and MFA. Incidents follow documented procedures, from triage to a post-incident review.
Breach notification is set out in the Data Processing Agreement.
Access controls
Compliance.tf follows the principle of least privilege across all systems.
- IAM policies grant only the minimum permissions each service and function needs.
- No shared credentials: every team member has individual access with multi-factor authentication.
- API tokens are scoped per customer and can be revoked at any time.
- Infrastructure access is logged and auditable.
- Production systems are isolated from development environments.
Incident response
Documented incident response procedures cover:
- Detection and triage.
- Containment and mitigation.
- Notification, within 72 hours for personal data breaches, as GDPR requires.
- Root cause analysis and remediation.
- Post-incident review.
The team runs regular incident response exercises. For breach notification in detail, see the Data Processing Agreement.
Found a vulnerability? Tell us.
Send a clear description, steps to reproduce and any evidence. Researchers who follow the guidelines in good faith face no legal action.
Responsible disclosure
If you have found a security vulnerability in compliance.tf, report it to mail@compliance.tf with a clear description of the issue, steps to reproduce, and any relevant evidence. We ask that you:
- Give us reasonable time to investigate and fix the issue before disclosing it publicly.
- Do not access or modify other users' data.
- Do not disrupt the service for other users.
We will not take legal action against researchers who follow these guidelines in good faith, and we appreciate the security community's help in keeping compliance.tf safe.
Governing documents
Data Processing Agreement
Compliance.tf processes personal data on your behalf as a data processor, on your documented instructions. The sub-processors are AWS, Plausible Analytics and Sprinto, with at least 30 days' notice before one is added or replaced. Standard Contractual Clauses apply to international transfers, and you can request return or deletion of data when the agreement ends.
Service Level Agreement
99.9% monthly uptime for paid subscribers, scheduled maintenance announced at least 48 hours ahead, support response from 4 hours (critical) to best effort (low), counted in business hours (Monday to Friday, 09:00 to 17:00 CET, excluding Norwegian public holidays) with critical issues monitored around the clock, and service credits through your AWS Marketplace subscription when the uptime target is missed.
Privacy Policy
At sign-up, your name, email and username, plus standard server logs (IP, browser, device). Payments go through AWS Marketplace, so compliance.tf never sees your payment details. You can access, correct or delete your data by writing to privacy@compliance.tf.
Related
The Trust Center and the Operational Rules page.