ComplyEasyAI FAQ: frameworks, AI, security and pricing

ComplyEasyAI is an AI-powered compliance automation platform that helps organizations achieve and maintain continuous readiness across global regulatory standards. It automates evidence collection, control monitoring, risk assessment, and audit preparation using autonomous AI agents and machine learning.

It is built for startups preparing for a first audit such as SOC 2 or ISO 27001, scale-ups managing several frameworks at once, and enterprises that need advanced automation and custom frameworks. It is a strong fit for regulated industries including FinTech, HealthTech, SaaS, and AI companies, as well as organizations subject to the EU AI Act, DMA, or DSA.

Signing up takes a couple of minutes, and AI-assisted framework setup typically takes 15 to 30 minutes. Automated evidence collection can begin within the first day, an initial compliance dashboard comes together within a few days, and audit-ready status generally follows over 30 to 90 days depending on the framework and your current maturity.

Yes, on request. Request a trial through the demo form and we agree the trial's scope and length with you. You can also create an account yourself; a new workspace starts with the Foundation plan's limits of three frameworks and up to 10 users.

Before a trial ends we agree the next step with you: move to a paid plan with all of your data preserved, extend the evaluation, or close the workspace.

Pricing is tier-based with flat annual rates: Foundation (3 frameworks, 10 users), Essentials (10 frameworks, 100 users), Growth (50 frameworks, 1,000 users) and Visionary (unlimited). Each plan is one platform price; your exact figure is a tailored quote based on your framework mix and team size, shared on a 30-minute call.

Yes, at any time. Upgrades take effect immediately with prorated billing. Downgrades take effect at the next billing cycle, and your current features remain active until then. There are no penalties for switching tiers.

Major credit and debit cards (Visa, Mastercard, Amex, Discover) are accepted for all customers. ACH bank transfer is available for US-based organizations, and wire transfer, purchase orders with NET 30 terms, and invoice payment are available for enterprise, Growth, and Visionary customers.

Trials carry no charges. On annual plans, a prorated refund for unused months is available after the first 30 days. Enterprise contracts follow their negotiated terms.

ComplyEasyAI has 16 in-depth framework guides: SOC 2, ISO 27001, NIST CSF, PCI DSS, GDPR, HIPAA, CCPA, India DPDPA, EU AI Act, NIST AI RMF, ISO 42001, AIUC-1, DORA, DMA, DSA and CSRD. Its in-app catalogue covers 150+ frameworks and standards, including ISO 27701, NIST 800-53, CIS Controls, FedRAMP, HITRUST, PIPEDA, LGPD, TISAX, FDA 21 CFR Part 11 and ITAR. Growth and Visionary plans can build custom frameworks.

aCOS is the autonomous compliance engine. It monitors your infrastructure continuously with AI agents, detects compliance drift in real time, remediates issues automatically when it is safe to do so, learns from your environment to adapt policies, predicts emerging risks, and orchestrates remediation workflows. The full aCOS loop is included in Growth and Visionary; continuous control monitoring is in every tier.

Evidence is collected through 26 verified integrations across cloud (AWS, Microsoft Azure), code (GitHub, GitLab), identity and HR (Okta, Google Workspace, BambooHR), security (CrowdStrike, Qualys) and ticketing (Jira, ServiceNow). You connect each one through OAuth, an API key or a personal access token, and the credential is checked with the provider before it is saved. Evidence is mapped to controls, collected on a schedule, and kept in a versioned audit trail.

Yes, with customization scaling by tier. Foundation lets you add custom controls to existing frameworks, Essentials lets you modify control requirements and evidence mappings, Growth lets you build custom frameworks from scratch, and Visionary adds full Compliance-as-Code using OPA/Rego policies.

Yes. You own your data and can export it at any time, with unlimited exports, in JSON, CSV, PDF, or XML. Exports cover evidence and attachments, risk assessments, control mappings, audit history, policies and procedures, and reports. The platform also supports data portability to help you migrate elsewhere without vendor lock-in.

Every tier includes core AI features: the AI Risk Analyzer for automated risk assessment and scoring, the AI Control Mapper for mapping evidence to controls, and a natural-language AI chatbot. Growth adds advanced AI such as predictive risk modeling, AI Red Team simulation, smart remediation, a compliance digital twin, and neuro-symbolic reasoning. Visionary adds federated learning, homomorphic encryption, multi-modal processing, and full AI governance.

No, but it augments your team significantly. The AI handles routine work such as evidence collection, control monitoring, risk scoring, report generation, and anomaly detection, freeing people to focus on strategic decisions, auditor relationships, policy design, exception approvals, and program leadership.

AI Red Team simulates adversarial review of your compliance program. It identifies gaps an auditor would likely catch, models how controls could be bypassed, tests your posture under stress, and generates reports on what to fix. It is simulation only with no actual attacks performed, and it is available in the Growth tier and above.

The chatbot answers natural-language compliance questions against your own data, such as listing open access-control risks, identifying missing evidence for a specific SOC 2 control, or generating an executive risk report. It only accesses your organization’s data, which is never shared across organizations, and it is available in all tiers.

Customer data is never used for AI training without explicit opt-in. Where supported, zero-knowledge techniques allow compliance to be verified without exposing the underlying data, and you control data access permissions and encryption keys.

With ComplyEasyAI, setup and gap assessment usually take a few weeks, remediation runs roughly 4 to 12 weeks depending on the gaps found, and SOC 2 Type II requires a 3 to 6 month observation period before the audit itself. End to end this commonly lands in the 4 to 9 month range, compared with the longer timelines typical of fully manual programs.

Yes, and this is a core strength of the platform. Many frameworks share a large portion of their controls, so the AI maps shared controls automatically, reuses evidence across frameworks, flags the unique requirements of each, and generates framework-specific reports. The number of concurrent frameworks scales with your tier.

SOC 2 Type I is a point-in-time assessment that evaluates whether controls are designed appropriately. SOC 2 Type II evaluates how effectively those controls operate over a 3 to 12 month observation period and is the report most enterprise buyers expect. The platform supports both Type I and Type II with continuous control monitoring.

Framework changes are tracked centrally. When a standard is revised, new controls are added to your instance, you receive advance notice, and AI assists the transition while preserving and remapping existing evidence. This has covered updates such as the ISO 27001:2022 revision and NIST CSF 2.0.

Yes. The platform helps you classify AI system risk, generate technical documentation for high-risk systems, run conformity assessments, manage required transparency disclosures and labeling, operate human-oversight governance workflows, and monitor data quality and accuracy. It is included in the Visionary plan's full EU stack (AI Act, DORA, DMA and DSA). After the 2026 Digital Omnibus amendments, most high-risk obligations apply from 2 December 2027 (Annex III systems) or 2 August 2028 (AI in products covered by Annex I).

The platform supports DMA obligations for digital gatekeepers, including gatekeeper assessment, mapping of the DMA obligations, documenting interoperability and data portability, monitoring self-preferencing and data-combination practices, and generating compliance reports. It is included in the Visionary plan.

The platform provides a DSA toolkit covering content-moderation tracking, notice-and-action workflows, automated transparency reporting, systemic-risk analysis for very large platforms, recommender-system documentation, advertising transparency, and user-rights request handling. It is included in the Visionary plan.

The GDPR toolkit helps you track processing activities, manage consent, handle data-subject requests for access, deletion, and portability, generate a Record of Processing Activities, conduct Data Protection Impact Assessments, and document your legal basis for processing.

SOC 2 Type I audit in progress; ComplyEasyAI does not yet hold a SOC 2 report or an ISO 27001 certificate. The controls in place today are encryption at rest (Supabase and AWS), TLS encryption in transit, integration credentials additionally encrypted with AES-256-GCM, multi-factor authentication, role-based access within each workspace, audit logging, and hosting in a single US region (us-east-1).

Customer data is hosted in a single US region (AWS and Supabase, us-east-1), with the application on AWS and the database on Supabase. Nightly database backups are kept for 30 days. There is no multi-region replication today. On-premises deployment is available on request for Visionary customers.

Your data is scoped to your organization and is never shown to other customers, and actions in the platform are written to an audit log. We do not use customer data to train AI models without your opt-in.

Yes. Bring Your Own Key is available on the Visionary plan, with support for AWS KMS, Azure Key Vault, Google Cloud KMS, and HashiCorp Vault. Keys can be rotated automatically or manually, and revoking a key renders the associated data unreadable. BYOK can be combined with client-side encryption for a zero-knowledge posture.

ComplyEasyAI has 26 verified integrations: connectors that check your credentials with the provider when you connect and collect evidence when they sync. Cloud and infrastructure: AWS, Microsoft Azure, DigitalOcean, Heroku and Kubernetes. Identity and HR: Okta, Google Workspace, BambooHR and ADP. Code and CI/CD: GitHub, GitLab, Bitbucket and CircleCI. Security: CrowdStrike and Qualys. Ticketing and work management: Jira, ServiceNow, Azure DevOps, Zendesk, Asana, Monday.com and Confluence. Communication: Slack, Discord, SendGrid and Twilio. The in-app catalogue lists further connectors that are not yet verified end to end.

Integrations connect through one-click OAuth where available, read-only API keys or personal access tokens, or webhooks for real-time events, and they are agentless with no software to install. The platform requests the minimum permissions needed, preferring read-only access.

Yes. The Webhook API and the REST and GraphQL APIs let you send evidence, trigger workflows, and query compliance data. A no-code Integration Builder is on the roadmap, and integration work by our team is available on request.

You can send evidence through the Webhook API, import it from CSV, or upload it manually, and ask us to add the integration. A public roadmap for integration requests is on the roadmap, and integration work by our team is available on request.

Uptime SLAs with service credits are available on request and are agreed in your contract; without one, no SLA applies. Live availability is published on the status page.

On-premises deployment is available on request for Visionary customers. It runs on your Kubernetes cluster with PostgreSQL, Redis and S3-compatible storage; packaging (including Helm) and support are agreed per contract. The standard service runs in a single US region (us-east-1).

API use is subject to plan quotas, from 1,000 requests a day on Foundation to 10,000 on Essentials, 100,000 on Growth and unlimited under fair use on Visionary, and to rate limiting. Requests over a limit receive an HTTP 429 response.

The API is available today: a documented REST API and a GraphQL API. SDKs for JavaScript/TypeScript, Python, Go, and Java, a command-line interface, and a Terraform provider are on the roadmap.

Every plan includes email support, the documentation, and the learning center. Growth and Visionary add priority support. For Visionary customers, 24/7 phone support, a critical-response SLA, and a dedicated Customer Success Manager are available on request.

Yes, on request. Compliance consulting (gap assessments, remediation planning, policy development, audit preparation, framework selection), implementation services (onboarding, integration setup, custom framework building, workflow design, team training), and managed services such as Compliance-as-a-Service and a virtual CISO are available on request and quoted separately.

Documentation, the learning center, and in-app guidance are available on every plan. Live training sessions and workshops for your team are available on request.

Yes. The audit-preparation program covers pre-audit work such as AI Red Team review, gap remediation, evidence packaging, and a mock audit; in-audit support with a secure auditor portal, instant evidence search, and question tracking; and post-audit help with response generation, finding remediation, and continuous monitoring to prevent recurrence.

Migration help is available on request. Our team can import your controls, evidence and policies from spreadsheets or your current compliance tool's exports, handle data mapping and validation, and run both systems in parallel during the switch.

Yes. White-labeling is available on the Visionary tier and includes custom branding (logo, colors, and domain), removal of ComplyEasyAI branding, custom email templates, and custom report headers and footers. It is a common fit for managed service providers, compliance consultants, and resellers.

Yes. Multi-tenant features let you manage multiple organizations from a single account, view consolidated cross-organization dashboards, apply role-based access with separate permissions per organization, and consolidate billing into a single invoice. This suits consultancies, managed service providers, and holding companies.

Custom frameworks are included in the Growth and Visionary plans. The following are available on request and quoted with your plan: on-premises deployment (Visionary), custom fine-tuned AI models (Visionary), a dedicated virtual CISO service, and audit bundling with a partner network of audit firms.