Compliance LockerCompliance Locker

Trust Center

Transparent, claim-safe answers about encryption, access, and operations. We do not claim SOC 2, ISO, or HIPAA certification by default.

What we can see

  • Account email and organization membership metadata
  • Encrypted file blobs and opaque storage keys
  • Encrypted metadata strings and key wrapping blobs
  • Share tokens, expiry, view counts, and hashed audit events
  • Billing status via our payment processor

What we cannot see

  • Your master password or derived vault keys (DEK)
  • Document plaintext or filenames in the clear
  • The FEK in a share URL hash fragment (never sent to our servers)

Zero-knowledge here means document contents are encrypted in the browser before upload. It is not an absolute claim about all metadata or analytics.

Architecture at a glance

Browser
  password → PBKDF2 → DEK
  file → AES-256-GCM → ciphertext + FEK wrap
       ↓
Server (Vercel)  →  Postgres metadata  →  R2 ciphertext
  session / MFA gate only
  never receives DEK or share #fragment

Status & assurance

We publish a claim-safe assurance posture—not certification theater. Today that means:

  • No SOC 2, ISO 27001, or HIPAA certification is claimed for Compliance Locker at this time
  • Independent pen-test reports: none published yet — we will link reports here when available
  • Architecture & crypto: described on Security (client-side AES-256-GCM, key custody, share model)
  • Subprocessors: listed at Subprocessors

Operational incidents and maintenance notices: support@compliancelocker.app. For buyer questionnaires, start from Security and this Trust Center rather than marketing slogans.

Account SSO (Google / Microsoft OAuth) is available for sign-in. SSO proves account ownership only; your master password still unlocks vault keys locally. Enterprise SAML/OIDC and SCIM remain on the roadmap. MFA, session inventory, share passwords, and escrow acknowledgements are available in-product.

Evaluator one-pager

What most security reviews need in the first pass:

  1. Encryption runs in the browser before upload (AES-256-GCM)
  2. Operators cannot decrypt document plaintext under normal operation
  3. Share keys can be delivered via URL hash fragments (not logged as ordinary request data)
  4. Share controls: expiry, view limits, optional password, watermark
  5. Insert-only vault activity is exportable for evidence requests
  6. Formal SOC 2 / ISO reports: not available yet — ask us for timeline if required for procurement

Print or share /security with this page for vendor reviews.

Related documents