Companies / Comply+ / Subprocessors
Comply+ provides FINTRAC reporting software, training, and filing support that turns transactions into validated report-ready drafts and submits them directly to FINTRAC. It serves Canadian compliance teams, including money services businesses, crypto companies, foreign exchange, armoured car, and casino businesses.
Summarized from its homepage on 8 Nov 2026.
Subprocessors of Comply+
Comply+ declares 12 subprocessors, including AI providers OpenAI.
| Subprocessor | Purpose |
|---|---|
| Cloud infrastructure underlying Supabase; encrypted credential storage (Secrets Manager) | |
| Error and performance monitoring | |
| Website analytics, marketing attribution, conversion tracking | |
| AI-powered note-taking and call transcription | |
| Support ticketing | |
| Web application hosting, serverless functions, CDN | |
| AI document extraction, KYC data structuring, STR narrative drafting (anonymized), transaction analysis (aiSTR™) | |
| Sanctions, PEP, and watchlist screening data (API) | |
| Product analytics | |
| Transactional email delivery (all Service email: invitations, calendar reminders, weekly digests, review requests and outcomes, training invitations) |
2 more subprocessors
See the full list with purpose, location and first seen date.
Create a free accountWork email, no card. Already have one? Log inQuestions about Comply+
Certifications
| Standard | What the source says | Checked |
|---|---|---|
| SOC 2 Type ICompany's statement | “SOC 2® Type 1 Report Encryption In Transit & At Rest”The company's own statement. SOC 2 has no public registry; the report itself is shared by the company, usually under NDA. | 13 Nov 2026Source |
We last read its homepage on 13 Nov 2026 and the FedRAMP Marketplace on 8 Nov 2026. A standard not shown here was not found in these sources. That does not mean Comply+ lacks it.
Vendor's own statement, retrieved from the source URL on the date shown. StrataDB does not verify the underlying claim. Data sources.
See Comply+'s full stack
Every vendor with its source and date, and an alert when Comply+ adds or drops one. The same lookup works for any company.
- Every company and vendor, with its public source
- 100 API calls a month, plus MCP and the Chrome extension
- Work email only. No card, no sales call