Snapshot 83119
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Security Last updated: March 25, 2026 Table of Contents Overview Trust Center Architecture Overview Encryption Module Integrity Access Controls Incident Response Compliance Responsible Disclosure 1. Overview We built security into how we design, build, and operate compliance.tf. This page gives you an overview of our security practices. For detailed compliance documentation, certifications, and downloadable resources, visit our Trust Center. 2. Trust Center compliance.tf Trust Center Our Trust Center has all our compliance and security documentation. It includes our SOC 2 reports, 40+ security controls, and downloadable resources including our ISMS Manual and System Description. Visit Trust Center 3. Architecture Overview compliance.tf is built on a serverless architecture designed for security and resilience: Static frontend served from Amazon S3 via CloudFront CDN. No server-side rendering means a minimal attack surface API runs on AWS Lambda. Each request executes in an isolated environment with no persistent state Data stored in Amazon DynamoDB with encryption at rest enabled by default Authentication handled by AWS Cognito with support for email/password and Google OAuth Infrastructure spans two AWS regions: us-east-1 (US) and eu-west-1 (Ireland) The serverless model means there are no servers to patch, no operating systems to maintain, and no long-running processes that could be compromised. 4. Encryption All data is encrypted, both in transit and at rest: In transit: TLS 1.2 or higher for all connections. There are no unencrypted paths. HTTP requests redirect to HTTPS automatically. At rest: AES-256 encryption via AWS Key Management Service (KMS) for all stored data, including DynamoDB tables, S3 objects, and CloudWatch logs. API tokens: API tokens are hashed before storage. We never store tokens in plaintext. 5. Module Integrity Modules downloaded from compliance.tf are not byte-for-byte copies of upstream open-source code. We apply two types of modifications at download time: Compliance controls add security configurations required by your chosen framework (SOC 2, PCI DSS, HIPAA, etc.) Operational rules add lifecycle blocks, remove provisioners, or restrict instance types based on your organization's configuration These transformations follow predefined rule logic scoped to your authenticated organization. They are not ad-hoc manual edits. The delivered output is standard HCL that you can read, diff against upstream, and review before deploying. For details on available rules, see the Operational Rules page and the documentation. 6. Access Controls We follow the principle of least privilege across all systems: IAM policies grant only the minimum permissions required for each service and function No shared credentials — every team member has individual access with multi-factor authentication API tokens are scoped per customer and can be revoked at any time Infrastructure access is logged and auditable Production systems are isolated from development environments 7. Incident Response We have documented incident response procedures that include: Detection and triage Containment and mitigation Notification (within 72 hours for personal data breaches, per GDPR) Root cause analysis and remediation Post-incident review We conduct regular incident response exercises to make sure our team is prepared. For more details on breach notification, see our Data Processing Agreement. 8. Compliance We maintain the following compliance certifications and commitments: SOC 2 Type II — available through our Trust Center GDPR — see our Privacy Policy and Data Processing Agreement for details AWS Well-Architected Framework — we follow AWS best practices for security, reliability, and operational excellence 9. Responsible Disclosure If you've found a security vulnerability in compliance.tf, we want to hear about it. Please report vulnerabilities to mail@compliance.tf with a clear description of the issue, steps to reproduce, and any relevant evidence. We ask that you: Give us reasonable time to investigate and fix the issue before disclosing it publicly Don't access or modify other users' data Don't disrupt the service for other users We won't take legal action against researchers who follow these guidelines in good faith. We appreciate the security community's help in keeping compliance.tf safe.