ComplyCore — Data Protection & Security

Find the data-protection and security problems in your code while you write it, mapped to the regulation that applies to you.

ComplyCore scans for personal data reaching places it should not — logs, third-party calls, unencrypted storage, API responses — and tells you which obligation each finding touches under NDPR/NDPA (Nigeria), GDPR (EU/UK) and PCI-DSS v4.0.

What it looks at

ComplyCore analyses how a value is used, not merely where its name appears. A password in an import, a type annotation, or a Swagger description is not a finding. The same value interpolated into a log line, sent to a third party, or written to a row without protection is.

Domain	Examples
Sensitive data	PII, financial data, credentials, government IDs (BVN, NIN, SSN, passport), biometrics, special-category data
Encryption	Hardcoded secrets, weak crypto (MD5/SHA-1/DES), plaintext transit, unsafe cache writes
Database	SQL built by string interpolation, embedded credentials, unrestricted or destructive statements
API security	Unauthenticated routes, JWT misuse, permissive CORS, personal data in responses, missing rate limits
Secrets	AWS, Stripe, GitHub, Google, Firebase keys, private keys, signing secrets
Governance	Consent gaps around special-category data, erasure and portability obligations
PCI-DSS	Cardholder data and sensitive authentication data — storage, logging, transmission

Findings are suppressed when the value is already protected: hashed with bcrypt or Argon2, encrypted, masked, bound as a query parameter, or excluded from serialisation.

Languages

JavaScript, TypeScript, JSX, TSX, Python, Go

Each language has its own lexer, so comments, docstrings, decorators, struct tags and raw strings are understood rather than pattern-matched.

Whole-project scanning

On opening a workspace, ComplyCore scans the whole repository and reports a single figure in the status bar — ComplyCore: 53 risks in ajo-app-backend — taking the project name from package.json. Opening a file adds its detailed, line-level diagnostics.

Team dashboard

Sign in and findings sync to your organisation's dashboard at app.getcomplycore.com: projects register themselves on first scan, admins add developers to projects, and compliance reports are generated per project and per framework. Findings resolve automatically once a scan no longer reports them.

Set complycore.requireAuth to false to scan locally without an account. Nothing leaves your machine in that mode.

Commands

Command
ComplyCore: Scan Whole Project	Rescan every file in the workspace
ComplyCore: Rescan Active File	Rescan the current file
ComplyCore: Project Risk Summary	Severity and domain breakdown
ComplyCore: Show Framework Breakdown	Findings grouped by NDPR / GDPR / PCI-DSS
ComplyCore: Show Data Flow Risks	Where sensitive values travel
ComplyCore: Show Logs	Output panel → ComplyCore
ComplyCore: Log In / Sign Up / Log Out	Account

Settings

Settings → ComplyCore

Setting	Default
`complycore.enabled`	`true`	Master switch
`complycore.frameworks`	all	Which regulations to report against
`complycore.severity`	—	Minimum severity shown
`complycore.confidenceThreshold`	—	Hide findings below this confidence (0–1)
`complycore.scanProjectOnStartup`	`true`	Scan the workspace on open
`complycore.scanSecrets`	`true`	Hardcoded credentials
`complycore.scanDatabase`	`true`	SQL and storage
`complycore.scanApiSecurity`	`true`	Route and response checks
`complycore.scanGovernance`	`true`	Consent and data-subject rights
`complycore.scanPci`	`true`	PCI-DSS rules
`complycore.scanDataFlow`	`true`	Value-flow analysis
`complycore.includeTestFiles`	`false`	Scan test files
`complycore.excludePatterns`	—	Globs to skip
`complycore.requireAuth`	`true`	Require sign-in before scanning
`complycore.apiUrl`	`https://api.getcomplycore.com`	API endpoint

What leaves your machine

Your source code never does. Analysis runs entirely inside the editor. When you are signed in, ComplyCore sends only the description of each finding:

the rule that fired, its title, severity and confidence
the line and column
the category of data involved (pii, financial, government_id, …) and the sink it reached
the framework references (NDPR, GDPR, PCI-DSS)
the file path relative to your project, and the project name from package.json

No file contents, no code snippets, no matched text, no variable values. A finding says "a government ID reaches a log at src/kyc.service.ts:988" — never what that line contains. Paths are workspace-relative by design, so your machine's folder structure and account name stay local.

Set complycore.requireAuth to false to scan with no account at all. In that mode nothing is transmitted and no network request is made.

Questions about data handling: support@getcomplycore.com

Scope

Analysis is per-file: a value is traced through assignments, calls and interpolations within a file, not across module boundaries. ComplyCore finds where sensitive data is handled unsafely; it does not prove that data is safe everywhere else.

It complements commit-time tooling rather than replacing it. To block commits containing secrets, add gitleaks or git-secrets.

Support

getcomplycore.com · support@getcomplycore.com