We run your program, not your patient data.
Complydome orchestrates your compliance program: policies, procedures, training, screenings, vendor agreements, risk assessments and the evidence an auditor asks for. It isn’t an EHR, and it isn’t built to store patient records. Keeping patient data out of the platform is one of the strongest security decisions we’ve made.
Built on infrastructure designed for healthcare.
AWS HIPAA-eligible services
Complydome runs on Amazon Web Services, in data centers with SOC 2 Type II attestations.
United States hosting
Customer data is stored and processed in the United States.
Encryption in transit and at rest
Data is encrypted as it travels and where it’s stored, with secrets kept in a managed secrets service.
Infrastructure as code
Environments are defined in code and deployed the same way every time, with automated backups.
Tenant separation
Every practice’s data is logically separated. Enterprise customers get their own fully isolated environment.
One tested platform
Every customer runs the same reviewed and tested code. No custom forks means no forgotten, unpatched versions.
The right people see the right things. Nobody else.
Two-factor authentication
Available for every user, adding a second check beyond the password.
Automatic account lockout
Repeated failed sign-in attempts lock the account temporarily to stop guessing attacks.
Unlimited custom roles
Decide, feature by feature, what employees, consultants, vendors and auditors can view or change.
Protected credentials
Passwords are never stored in plain text, and password changes are tracked.
Records that hold up, because they can’t be quietly changed.
Compliance evidence is only worth something if it’s trustworthy. Complydome is built so the record of what happened stays intact.
Tamper-evident audit logs
Changes are logged with who made them, when, and from which IP address and browser, and each entry is sealed with a cryptographic hash.
Role and permission history
Every change to a role or permission is recorded, so you always know who could see what, and when.
Timestamped acknowledgments
Employee policy acknowledgments are recorded with date, time and IP address.
Long-term retention
Audit records are retained for multiple years, and policy and procedure versions are kept in full.
Your data is yours.
- YesYour practice owns everything you put into Complydome.
- YesWe use your data only to provide, secure and support the service.
- NeverWe never sell your data, use it for advertising, or train general AI models on it.
Details are in our Privacy Policy and Terms of Service.
Who helps us run Complydome
We work with a small number of established providers, each under contractual confidentiality and security obligations.
| Provider | Purpose | Data involved |
|---|---|---|
| Amazon Web Services | Cloud hosting, storage, databases and messaging | Platform data |
| Stripe | Payment processing | Billing contact and payment details. Card numbers are handled by Stripe, not stored by us |
| Formspree | Website contact and request forms | Information you submit through our website |
| Google Analytics | Website analytics, only with your consent | Website usage data |
Our public website also uses an IP-based location service to show region-specific content. A complete list of subprocessors is available on request.
If something goes wrong, you’ll hear it from us.
- Detect and contain. We investigate suspected incidents promptly and act to limit their impact.
- Assess. We determine what happened, what data was involved and who is affected.
- Notify. We notify affected customers as required by law and by our agreements, including our Business Associate Agreements.
- Learn. We document the root cause and the steps taken so it doesn’t happen again.
Where we stand, stated plainly
- In placeBusiness Associate Agreement signed with every practice during onboarding.
- In placeHosting on AWS HIPAA-eligible services, in data centers with SOC 2 Type II attestations.
- EnterpriseDedicated, isolated environments with single sign-on for hospitals and health systems.
Found something? Tell us.
If you believe you’ve found a security vulnerability in Complydome, email support@complydome.com with the subject “Security report.” Please give us a reasonable chance to fix the issue before sharing it publicly, and don’t access or change data that isn’t yours. We take every report seriously.