Network diagrams, SSPs, and control narratives stay in a local Docker volume. The app does not sync to the cloud or collect usage telemetry.
Everything you create in CompliNIST — topology diagrams, device inventories, security boundaries, SSP documents, and control narratives — is stored in a SQLite database inside the Docker volume. There is no cloud sync, no telemetry, and no usage analytics collected from the application.
The CompliNIST application itself does not phone home with your compliance data. If you create a website account, authentication is handled by Clerk over HTTPS. Optional subscription payments go through Stripe. You can run the full compliance workflow offline after pulling the Docker image — no account required.
If you're working on an authorization package for a federal system, your network diagrams describe exactly how that system is protected. Teams in secure facilities, on air-gapped networks, or under strict data-handling policies need a tool that keeps sensitive architecture details under their direct control.
Website account authentication is handled by Clerk. Auth traffic is HTTPS-encrypted. The CompliNIST Docker app does not require a website account to run.
Compliance data lives in a SQLite database at /data inside the container, typically backed by a Docker named volume or host bind mount. There is no automatic cloud backup or remote sync.
We don't collect telemetry from the application. We don't send your compliance data to third-party analytics services.
See our vulnerability disclosure policy for safe harbor and reporting instructions.
cam@complinist.comPlease report vulnerabilities via email, not through public channels.