Scope
This page describes the Complifly platform. For the details you give us in website forms, see Privacy and DPDP.
What we can describe
People signing in
Local accounts or an external identity provider, with session tokens, one-time codes and password reset.
ERPs authenticating
An ERP connection authenticates with Microsoft Entra ID tokens issued from your own directory. Complifly does not hold your client secret; you rotate it in your directory on your own schedule.
Role-based access
People have roles, and access can be scoped to the registrations they are responsible for.
Approvals by a second person
Maker-checker: the person who creates an action is not the person who approves it.
A trace of changes
Changes to e-invoices, e-way bills and mappings are recorded with who and when.
Tenant boundary
The organisation (PAN) is the tenant boundary, with GSTIN entities beneath it.
If something goes wrong
If we become aware of a security incident that affects your data, we tell your named contact without undue delay, and share what we know as we learn it.
Your part
You manage your own users and ERP connection secrets: give access only to people who need it, remove people who leave, and rotate secrets on your own schedule. The Terms of Service set this out.
What we do not claim here
We do not publish an independent penetration-test result or a certification (see Compliance and assurance).
We do not state encryption or hosting-location specifics on this site. Send us your security questionnaire and we will answer from verified facts.
We do not state an uptime figure. See Status.