Security & Data Protection
ComplyPost is designed for regulated firms that handle sensitive client correspondence. Data protection and security are built in by design, not bolted on afterwards.
UK GDPR compliance
ComplyPost processes personal data on your behalf as a data processor under the UK GDPR. We provide a full Data Processing Agreement (DPA) covering your obligations under the Data Protection Act 2018 and the retained EU GDPR.
Data retention
Letter data is retained for the duration of your subscription and deleted within 30 days of account closure unless you export it first. You can configure per-organisation retention windows in your settings.
Infrastructure
All data is stored in EU/UK data centres. Data in transit is encrypted with TLS 1.2+. Data at rest is encrypted using AES-256. We do not sell or share your data with third parties.
Access controls
Role-based access control (RBAC) ensures team members only see what they need to. Multi-factor authentication (MFA) is available for all accounts and mandatory for owners.