Security and data handling
GetComply may handle policies, vendor assessments, risk records, evidence, and other information about a client's systems. The type of information and the access required depend on the engagement.
Information we request
We ask for records relevant to the agreed work. This may include existing policies, review records, screenshots, system exports, vendor documents, and descriptions of operating procedures. Clients should not provide credentials or unrelated sensitive data through the website inquiry form.
Access to client systems
Direct system access is not a standard requirement. Where records can be provided through an approved export or existing customer tool, that may be sufficient. Any requested access must have a defined purpose and be authorized by the client.
GetComply does not perform routine production changes under its standard managed GRC scope. Technical implementation remains with the client's team or an authorized technical provider.
Working documents
We agree on how documents and evidence will be exchanged and delivered during onboarding. GetComply may use internal systems to manage the work, but we do not offer a customer-facing GetComply portal as part of the standard service.
Documents remain usable by the customer outside GetComply's internal tools. Ownership, export, return or deletion, and offboarding terms are set in the client agreement.
Website providers
The website is hosted through Cloudflare. Business email uses Microsoft 365. Website inquiries are delivered to HubSpot through the contact form. The Privacy Policy describes the information collected through public inquiries.
Report a security issue
If you believe you have discovered a security issue involving our website, contact [OWNER TO CONFIRM: monitored security reporting address and approved reporting procedure]. Include the affected URL or service, a description of the behavior, and sufficient detail to investigate without sending passwords or another person's private information.
Questions about information handling
For questions about our practices before entering an engagement, contact GetComply. Client-specific confidentiality and data-handling terms belong in the signed agreement.