ComplyFlow and AWS: What It Means for Your Data

Most people landing on this page are not after a press release. They are part-way through a vendor security review, with a line in the questionnaire about where the data is hosted. Here is the announcement, then the part that helps you answer it.

What We Announced in October 2025.

On 2 October 2025 we announced that ComplyFlow had worked with AWS through its DevCraft program: an architecture design session with AWS Solutions Architects that redesigned the infrastructure behind our AI features to carry several parallel AI workloads instead of one. Out of it came the automatic document review and faster prequalification processing we launched that month, timed for the WHS Safety Conference.

That is the whole of the news. On its own it is an engineering story, not a reason to buy anything. The sentence underneath it is the one that follows you into procurement: ComplyFlow runs on AWS. Our Help Centre article on platform architecture and hosting states that ComplyFlow has been qualified under the AWS Foundational Technical Review since 2023,¹ a review AWS describes as an assessment against Well-Architected best practice in security, reliability, and operational excellence, valid for two years.²

What AWS Secures, and What We Secure.

The most useful thing to understand about any vendor that runs on AWS is that AWS does not secure the vendor’s software.

AWS publishes this as its shared responsibility model, and the split is clean. AWS protects the infrastructure that runs its cloud services: the hardware, the software, the networking, and the facilities.³ The customer of AWS, which here is ComplyFlow, is responsible for what it puts in it. AWS’s wording on data privacy is blunt: you own your customer content, you choose the Region it is stored in, you choose how it is secured, and you manage access through users, groups, permissions, and credentials you control.⁴

The consequence for a buyer is direct. Every question in your questionnaire about encryption keys, password policy, role-based access, audit logs, tenancy separation, retention, and deletion is about ComplyFlow, not AWS. No AWS certificate answers one of them, and our security page is where the answers live.

Where the Data Lives, and What We Have Published.

Our Help Centre states that all ComplyFlow data is securely hosted within Australia,¹ which answers the data sovereignty question most Australian procurement teams ask first.

It does not name the AWS Region, and I am not going to guess at one here: a Region name in a marketing page is exactly the detail that gets copied into a contract schedule and turns out to be wrong. If your review needs it named, ask us and we will put it in writing.

Region matters more than the word suggests. AWS commits that it will not move or replicate your content outside your chosen Regions without your agreement,⁴ so the Region is a decision your vendor takes on your behalf. It also sits behind Australian Privacy Principle 8, on the steps an entity must take before personal information is disclosed overseas, and Australian Privacy Principle 11, which requires reasonable steps to protect personal information from misuse, interference, loss, and unauthorised access.⁵

What AWS’s Certifications Cover, and What They Do Not.

AWS holds a long list of certifications and attestations, and vendors like putting the logos on a page. Two lines from AWS’s own compliance material are worth more.

The first is on AWS’s compliance programs page, where it appears twice: AWS customers remain responsible for complying with applicable compliance laws, regulations, and privacy programs.⁶

The second is on AWS’s ISO/IEC 27001 FAQ page. AWS’s certification covers its security management process over a specified scope of its own services and facilities, and AWS states plainly that a business is not certified by association.⁷ Running on certified infrastructure does not make the software certified.

ComplyFlow holds its own ISO 27001 certification, which we announced when we first achieved it and which the Help Centre still lists.¹ That is the certificate relevant to you. Ask for it, and ask what its scope covers, because a certificate can cover part of a business rather than all of it.

AWS’s own auditor-issued reports sit behind AWS Artifact, a self-service portal reached through an AWS account.⁸ If you do not hold one, do not chase them: they describe AWS, not the software running on it.

Five Questions to Ask Any Software Vendor About Hosting.

1. Where is the data stored? Country and Region, named, and committed to in the contract.
2. Who can access it? Which roles at the vendor can reach customer data, under what approval, and whether that access is logged.
3. What happens on exit? In what format the data comes back, how long the vendor keeps it, and what evidence you get that it was deleted.
4. What is the backup and recovery position? How often, where the copies sit, how long a restore takes, and when it was last tested.
5. What does the certificate cover? The scope statement, not the logo, and whether that scope includes the service you are buying.

None of the five is answered by a hosting provider’s certificate. All five are answered by the vendor, or not at all.

Put the Five Questions to Every Vendor on the List.

If you hold the pen on this in compliance or legal, put the five questions to every vendor on your shortlist, not only to us. They sort a shortlist faster than a feature comparison does: most vendors can produce a feature, far fewer can produce a scope statement.

If you are the CFO signing it, press hardest on exit. It is the only one that gets more expensive after the signature.

If the questionnaire has a section on how ComplyFlow connects to the systems you already run, our integrations page covers it. Or book a demo and bring the questionnaire. We would rather answer it live than watch you guess.