Privacy Policy

1. Who we are

SuperCompli provides compliance software for US export control regimes, principally the International Traffic in Arms Regulations (ITAR). This policy covers the SuperCompli web application and marketing site.

2. Information you give us

• Account details. Your email address, company name, and role within your organization.
• Compliance questionnaire data. Your answers in the eligibility, registration and ICP workflows, including information about your products, processes and business activities.
• US person verification records. To support ITAR access determinations, we store the type of identity document you provided, the last four digits of a Social Security Number where you supply one, the verification status, and the identity of the administrator who reviewed it. The identity document itself is encrypted in your browser before upload and is described in section 4.
• Billing information. Handled by Stripe. We receive subscription status and the last four digits and brand of your card. We never receive or store your full card number.
• Support correspondence. Messages you send us through contact and help forms.

3. Information collected automatically

• Audit events. The service records compliance-relevant actions — who did what and when — because an audit trail is a regulatory expectation for ITAR programs. These records include the acting user's email address and are retained for your organization's compliance history.
• Authentication and security data. Session records, and if you enable two-factor authentication, an encrypted time-based one-time password secret.
• Operational logs. Standard request logs from our hosting provider, used to run and secure the service.

4. Content we cannot read

Secure chat messages, files in the encrypted vault, and uploaded identity verification documents are encrypted in your browser using keys that never leave your device in usable form. We hold only ciphertext. We cannot read this content in plaintext or recover your private key if you lose both your recovery phrase and every device holding a usable copy of that key.

Your private key is stored in your browser and is additionally wrapped under a recovery phrase that only you hold. Organization key recovery is not available. Administrators can access files and verification documents shared with them, but cannot restore your private key or recovery phrase.

If you connect Google Drive or OneDrive as a storage location, those providers receive only encrypted files. They cannot read their contents.

5. How we use information

We use the information above to:

• provide, operate and support the service;
• generate the compliance outputs you request, such as ICP documents and registration guidance;
• maintain the audit trail your compliance program depends on;
• process payments and manage subscriptions;
• send transactional email such as invitations, verification codes and notices;
• secure the service, including rate limiting and abuse prevention.

We do not sell personal information, and we do not use your compliance data or your content to train machine learning models.

6. AI features

Where you use Compli AI, the text of your question and relevant excerpts from the reference material are sent to our AI providers to generate a response. Content that is end-to-end encrypted is not included. If your organization supplies its own API key, requests are made using that key instead.

7. Service providers

We rely on the following providers. Each receives only what it needs to perform its function.

• Neon — database and authentication (United States, us-east-1)
• Vercel — application hosting
• Stripe — payment processing
• Resend — transactional email
• Backblaze B2 — encrypted file storage
• Upstash — rate limiting and caching
• Anthropic — AI assistance
• Voyage AI and Cohere — search relevance for reference material
• Botpoison — form abuse prevention
• Google and Microsoft — optional cloud storage, at your election

8. Export control and data location

The service is designed for US export control workflows. Our database and primary storage are located in the United States. Because technical data subject to ITAR may not be disclosed to foreign persons without authorization, you are responsible for determining which of your personnel may access your organization's data, and for using the access controls the service provides.

End-to-end encryption means that content in secure chat, the vault and identity verification is not accessible to SuperCompli personnel regardless of location.

9. Retention

We keep account and compliance data for as long as your account is active. Audit events are retained as part of your compliance record. When you request deletion, we remove your account data on the schedule described in our deletion process; encrypted content becomes permanently unreadable once the associated keys are destroyed, whichever occurs first.

10. Your choices

You may access and correct your account information in the application, export compliance documents you have generated, and request deletion of your account. Depending on where you live, you may have additional rights over your personal information; contact us and we will respond as required by applicable law.

11. Security

We use end-to-end encryption for the content categories described in section 4, encryption in transit throughout, encryption at rest for stored credentials and secrets, role-based access controls, and an audit trail. No system is perfectly secure, and you are responsible for safeguarding your recovery phrase — we cannot restore it.

12. Children

The service is intended for business use and is not directed to anyone under 18.

13. Changes

We will update this policy as the service changes and will revise the date at the top. Material changes will be communicated through the application or by email.

14. Contact

Questions about this policy can be sent to privacy@supercompli.com. See also our Terms of Service.