Company · Security at Compyl

Secure by design, proven by audit.

Scale your organization securely with Compyl, the GRC platform built by security practitioners. Data security, application security, and infrastructure security are designed in from day one, monitored continuously, and proven by an independently audited SOC 2 Type II.

Request a demo See how we secure your data →

SOC 2Type II, independently audited

AES-256Encryption at rest, TLS in transit

100%Calls secured over HTTPS

1,000sEnvironments monitored every day

We are a trusted partner

Three layers of security, built in.

Compyl protects your data, your applications, and the infrastructure they run on, using the same security stack we help our customers govern.

Data security

Compyl monitors customer environments and stores all data in secure databases, with encryption protecting every asset. We use tools like Azure Key Vault, Microsoft Identity, Microsoft Authorization, and secure private endpoints. All files uploaded to Compyl are encrypted and stored in Microsoft Blob Storage.

Application security

Compyl partners with many of the world’s leading third-party penetration testing services. We constantly evaluate the source code, running applications, and deployed environments. API keys are stored in Azure Key Vault, the app is covered by unit and automation testing, and internal errors are logged in Microsoft Log Analytics.

Infrastructure security

Compyl uses Azure Web Apps to host customer environments and leverages the full Azure security ecosystem: Key Vault, Blob Storage, Log Analytics, Virtual Networks, and Private Endpoints. The application is powered by a REST API microservices architecture, and every call to and from your environment is secured with HTTPS.

Responsible disclosureFound a security issue? Report it through our responsible disclosure process — our security team investigates every report.

We practice what we preach

We run the same program we sell.

Compyl was built by information security experts, so our own posture is held to the standard we help thousands of teams reach. We maintain an independently audited SOC 2 Type II and monitor our environments every day.

Recognized by users on G2 · Rated a leader by the teams who use it G2 Momentum Leader, Summer 2026

1,000s

Environments monitored every day

SOC 2

Type II, independently audited

AES-256

Encryption at rest, TLS in transit

100%

Calls secured over HTTPS

FAQ

Security questions, answered.

Is Compyl SOC 2 compliant?

Yes. Compyl maintains a SOC 2 Type II report, independently audited against the AICPA Trust Services Criteria. Customers and prospects can request the report through our team.

How does Compyl protect my data?

All customer data is encrypted and stored in secure databases. Uploaded files are encrypted and stored in Microsoft Blob Storage, secrets and API keys are held in Azure Key Vault, identity and authorization run on Microsoft Identity, and access is restricted with secure private endpoints.

Where is Compyl hosted?

Compyl runs on Microsoft Azure using Azure Web Apps, and leverages Azure security products including Key Vault, Blob Storage, Log Analytics, Virtual Networks, and Private Endpoints. The application uses a REST API microservices architecture, and every call to and from a customer environment is secured over HTTPS.

Does Compyl perform penetration testing?

Yes. Compyl partners with leading third-party penetration testing services and continuously evaluates source code, running applications, and deployed environments, backed by unit and automation testing, with centralized error logging in Microsoft Log Analytics.

How do I report a security concern?

If you’ve found a potential vulnerability, please reach out through our responsible disclosure process so our security team can investigate and respond.

GRC your way

Rapidly mature your security program with Compyl.

An all-in-one, streamlined GRC platform created by information security experts, built secure, monitored continuously, and independently audited.

Request a demo Talk to our team →

Last reviewed September 2026 by the Compyl GRC team