Safeguards and limits
What ComplyAI does — and what it will never do
Compliance runs on trust. Here, in plain terms, are the boundaries the tools operate within: what they do autonomously, what always requires you, and the technical mechanisms that guarantee it. These are not marketing promises: they are rules written into the product and verifiable.
Autonomy and control
AI analyses are drafts, not verdicts.
Every generated item (clause, control, obligation) stays editable before you save it: you decide what to keep. The tool does not decide for you.
No irreversible action without you.
You initiate saves and deletions; deletions ask for explicit confirmation. The app never deletes or alters your data on its own.
No external communication
The app does not communicate externally on your behalf.
No email, message or transfer to third parties is generated automatically. Reminders live in your own calendar via an .ics file that you export and import.
The only external transmission is AI analysis: optional and transparent.
Only if you are signed in and enable AI analysis, the text (not the file) is sent to the EU LLM provider for analysis only, with mandatory training opt-out (D14/D15). Everything else runs in your browser or on your database.
Immutable audit trail
The audit log is immutable, even for you.
Every create, update and delete is recorded in an append-only log protected at three levels (RLS, REVOKE, a DB trigger blocking update/delete): no one can alter or erase it. It is an integrity guarantee for an external auditor (D10/D16).
No absolute legal certainty
Informational support, not legal advice.
Results cite the legal basis but do not replace a qualified professional. For decisions with legal effects (signing, negotiating, final classification), consult a lawyer.
What is not yet certain is flagged.
Dates and rules stemming from legislation not yet published in the EU Official Journal (Omnibus package) are explicitly flagged, not presented as in force (D6/D9).
Data and privacy
Minimal data, in the EU.
We keep the bare minimum — e.g. the review memo, not the full contract — on EU-region infrastructure (GDPR). The contract document stays in your browser unless you explicitly request AI analysis (D10/D15).
Your data is yours alone.
Per-user Row Level Security: each row is readable only by your account. The public client key gives no access to others' data; security is declared in the SQL schema (D10).
Determinism and reproducibility
Deterministic rules where possible.
The AI Act classification and the clause library are rule engines with precise citations: same question → same result → same source. Verifiable, reproducible and covered by tests (D4/D9/D15).
AI is never a single point of failure.
Wherever we use AI there is always a local deterministic fallback: if the provider does not respond or returns invalid output, the analysis continues with the local library and we tell you clearly (D14/D15).
Guardrails version: v1.0 (7 luglio 2026)
These principles apply to every module of the suite. The codes in brackets (e.g. D10) refer to the project's decision log.