At Comma Compliance your data security and privacy are our highest priorities. We protect your communications with industry-standard controls, trusted cloud infrastructure, and strict access governance, all designed to meet the expectations of SEC, FINRA, and global regulatory bodies. You trust us to protect sensitive business communications. We take that trust seriously.
Encryption at Every Stage
- All communications are encrypted in transit using TLS 1.2+ protocols and encrypted at rest with AES-256 encryption.
- We use cloud-native key management through AWS KMS and Azure Key Vault to control encryption keys securely.
Authentication and Access Management
- Access to your data is protected by single sign-on (SSO) integrations, multi-factor authentication (MFA), and strict role-based access controls (RBAC).
- All user activity and administrative actions are logged in immutable audit logs.
Continuous Monitoring and Testing
- Comma Compliance conducts daily vulnerability scans, regular independent penetration tests, and proactive threat detection across all systems.
- Our platform is continuously monitored for unauthorized access attempts or suspicious behavior.
External Certifications
- SOC 2 Type 2 audit in progress, covering Security, Availability, and Confidentiality Trust Services Criteria; expected completion Q3 2026. Signed status letter available to qualified prospects under NDA.
- Google OAuth CASA assessment passed for Gmail and Workspace integrations
Infrastructure and Data Storage
Comma Compliance is hosted across Amazon Web Services (AWS) and Microsoft Azure cloud environments, leveraging world-class security, compliance, and resiliency standards.
Our infrastructure includes:
- Multi-AZ clustering and automatic failover
- Encrypted backups every six hours with 35-day retention
- Service uptime target of 99.9%
- Recovery Point Objective (RPO) of 15 minutes
- Recovery Time Objective (RTO) of under 4 hours
All archived messages are stored immutably using Write-Once-Read-Many (WORM) retention policies, designed against SEC Rule 17a-4(f).
Additionally, all client data benefits from highly durable storage architecture, designed to provide 99.999999999% durability and 99.99% availability of objects over a given year, aligning with AWS’s highest standards for enterprise-grade data protection.
Data Residency
By default, client data is stored within the United States. Enterprise plans include optional data residency in the EU and Asia-Pacific for organizations with specific regulatory requirements — including MiFID II, FCA SYSC 10A, MAS, and ASIC recordkeeping obligations.
Data Ownership and Privacy
You retain full ownership of your data.
Comma acts as a secure custodian of your communications, using your information strictly to deliver archiving, compliance, and risk analysis services.
We never sell, rent, or share client data outside of authorized sub-processors directly involved in service delivery.
Privacy is protected at the point of capture. Our system automatically separates business-related communications from personal content, minimizing data exposure and respecting employee privacy rights.
AI-Driven Compliance Monitoring
Comma Compliance’s AI engine scans more than 95% of archived content for potential policy violations in real time. Messages flagged for review are always subject to human validation before escalation.
Key Principles:
- AI assists but does not replace human oversight.
- Every flag includes a clear reason and reference to relevant policy.
- Clients can adjust, refine, and contribute feedback to improve detection models.
- No client-specific data is used for system-wide training without explicit consent.
Our automation enhances compliance efficiency while maintaining full transparency.
Regulatory Alignment
Comma Compliance’s platform is designed against core requirements under:
- SEC Rule 17a-4
- FINRA Rule 4511
- GDPR and other applicable privacy regulations
We provide flexible retention periods, support for legal holds, full-text search, exportable archives (PDF, EML, JSON), and tamper-protected record integrity validated by cryptographic hash chains.
You stay audit-ready without extra manual overhead.
Contact and Security Reporting
For questions or concerns related to security, or to report a potential vulnerability, please contact our security team directly:
Comma Compliance
Email: security@commacompliance.com
Phone: 888-884-3318
Address: 2261 Market Street STE 22253, San Francisco, CA 94114
For more information on specific key security terms, visit our compliance glossary, or visit our Trust Center for more information on certifications, policies, and controls.