Security
Last updated 2026-09-23
CompSlate holds compensation data, which people rightly care about. This page says plainly how we protect it. It lists what the service actually does today; we don't hold security certifications (such as SOC 2) yet.
Infrastructure
- The service runs on Amazon Web Services in the United States (us-east-1): AWS Lambda for the application and Amazon DynamoDB for data.
- All traffic is HTTPS. Requests reach the application through Amazon CloudFront, which redirects plain HTTP to HTTPS and accepts TLS 1.2 or newer on our domain. We also send an HSTS header so browsers only connect over HTTPS.
- The application only answers requests that come through CloudFront: CloudFront adds a secret header, and requests without it are refused.
- Data in DynamoDB is encrypted at rest. Point-in-time recovery is on, so the database can be restored to any moment in the last 35 days, and the table has deletion protection.
- The application runs under its own AWS IAM role that can only read and write its own table and send email, nothing else.
- Secrets we generate (the signing key, the CloudFront origin secret and webhook secrets) are random values stored as encrypted parameters in AWS Systems Manager Parameter Store, not in our code.
- Server logs are kept for 90 days and then deleted.
Signing in
- There are no passwords. You sign in with a one-time link emailed to you, which works once and expires after 20 minutes.
- Sessions last up to 30 days, in a cookie that scripts can't read (HttpOnly, SameSite=Lax, and Secure on our live site). Signing out ends the session on our side.
- Sign-in links, session tokens and assistant tokens are stored only as SHA-256 hashes, so a copy of our database wouldn't let anyone sign in.
- Sign-in attempts are rate limited: 5 per email address every 15 minutes and 30 per IP address per hour.
AI assistants
- Assistants such as Claude and ChatGPT connect with OAuth 2.1, and PKCE (S256) is required. You approve each connection yourself, signed in to your workspace.
- Access tokens last 1 hour. Refresh tokens last 90 days and work only once: each use replaces them with a new pair. Authorization codes expire after 10 minutes and work once.
- An assistant acts as the person who connected it and sees only what that person can see.
- We only receive the tool calls an assistant makes, not your conversations.
- Tool calls are rate limited per person (600 a minute).
Inside a workspace
- Access is role based. Admins can see and change everything in their workspace; managers see their teams; everyone else sees their own comp card, plus anything an admin shares with them. Only admins can change people, plans, deals and pay.
- Changes that affect pay are previewed first and saved only when an admin confirms them. Periods marked as paid are locked.
- Changes are recorded in an activity log: who made each one, when, and whether it came from the web app or an AI assistant. Admins can review it at any time.
- Export links an assistant creates are signed and expire after 15 minutes.
- Each workspace's data is kept separate, and every request is checked against the signed-in person's workspace and role.
Web app protections
- Forms carry a CSRF token tied to your session, and every form submission must come from our own site (same-origin check).
- Pages are sent with a strict Content Security Policy, cannot be framed by other sites, and load code only from us plus fonts from Google Fonts.
We send email through Amazon SES from our own domain, authenticated with DKIM, SPF and DMARC, so receiving mail servers can tell a real CompSlate email from a forgery. Sign-in emails only ever link to our own site.
Reporting a vulnerability
If you think you've found a security issue, email security@compslate.com with the details and steps to reproduce it. Please give us reasonable time to fix it before telling anyone else, and don't access or change other people's data, disrupt the service, or run automated scans that put load on it. We'll acknowledge your report, keep you updated, and won't pursue legal action against good-faith research that follows these guidelines.
Contact
Security reports: security@compslate.com. Security questionnaires, privacy and legal questions: legal@compslate.com.