We can’t lose
what we never held.

1. The software

Complyology is installed on infrastructure you control. Assessment data, evidence files, POA&M records, SPRS scores, policy documents and audit logs live in a database on your disk. They are never transmitted to us. The product contains no telemetry, no usage reporting, and no automatic update channel that would carry data outward.

This is an architectural property, not a promise about our intentions. There is no endpoint for your instance to call home to.

2. This website

complyology.io is a set of static pages. Specifically, it:

• sets no cookies;
• runs no analytics, no tag manager, no advertising or tracking pixels;
• contains no forms — every contact route is a plain mailto: link that opens your own mail client;
• stores one value in your browser: a theme preference under the key cy-theme, so the site remembers whether you chose light or dark. It never leaves your browser, and clearing site data removes it.

Whoever hosts this site will keep ordinary server logs — typically IP address, timestamp, requested path and user agent — for operational and security purposes. That is a property of serving a website over HTTP, and we mention it because a privacy policy that pretends otherwise is not worth reading.

3. Third parties: none

This site makes no cross-origin requests at all. Every asset — stylesheets, scripts, images and typefaces — is served from complyology.io itself.

That last one is the part most sites get wrong. Loading webfonts from a font CDN means every visitor's browser discloses its IP address and user agent to that provider purely in order to render text, and no amount of cookie policy covers it. Our typefaces are SIL Open Font License families served from this origin, so the request never leaves.

There is no analytics provider, no tag manager, no CDN, no embedded video, no chat widget and no advertising network. Not because we removed them — because they were never added.

4. If you email us

Mail sent to sales@, support@ or security@complyology.io reaches an ordinary mailbox. We keep what you send us — your address, your message, and anything you attach — for as long as we need it to answer you and to keep a record of the conversation.

Please do not email us CUI, evidence files, or exports from a live assessment. We do not want them, we are not a cloud service provider for your covered defense information, and sending them to us would create exactly the problem the product exists to avoid. If you need to show us something to get support, redact it first.

5. Your rights

Because we hold so little, most data-subject requests resolve quickly: the only personal data we are likely to hold about you is correspondence you initiated. Write to privacy@complyology.io and we will tell you what we have, correct it, or delete it.

Data held inside your Complyology instance is yours, and requests about it are yours to answer — we cannot action them, because we cannot reach them.

6. Changes

If this policy changes materially we will update the date at the top of this page and note what changed. We will not quietly broaden it.