ComplyCore — Data Protection & Security

Find the data-protection and security problems in your code while you write it, mapped to the regulation that applies to you.

ComplyCore scans for personal data reaching places it should not — logs, third-party calls, unencrypted storage, API responses — and tells you which obligation each finding touches under NDPR/NDPA (Nigeria), GDPR (EU/UK) and PCI-DSS v4.0 — and, when you turn them on, POPIA (South Africa), the Kenya and Ghana Data Protection Acts and UK GDPR.

What it looks at

ComplyCore analyses how a value is used, not merely where its name appears. A password in an import, a type annotation, or a Swagger description is not a finding. The same value interpolated into a log line, sent to a third party, or written to a row without protection is.

Findings are suppressed when the value is already protected: hashed with bcrypt or Argon2, encrypted, masked, bound as a query parameter, or excluded from serialisation.

Quick fixes

Put the cursor on a finding and press Ctrl+. (Cmd+. on macOS). Where the fix is mechanical, ComplyCore offers it:

Fixes that need judgement, such as rewriting a query to bind its parameters, are not automated.

Accepting a finding

If a finding is a deliberate decision, record it next to the code with a reason. Ignore on this line and Ignore in this file in the quick-fix menu write the comment for you:

// complycore-ignore-next-line SD-THIRD_PARTY-pii-email -- Resend is our email processor (DPA signed)
await resend.emails.send({ to: user.email, subject, html });

complycore-ignore after code covers that line, and complycore-ignore-file covers the whole file. Rule ids accept a trailing * (SD-LOG-*). The same comments are honoured by the ComplyCore CLI and GitHub Action.

CI and the command line

The same scanner runs outside the editor with no account:

npx complycore scan .                     # text report, exit 1 on high findings
npx complycore scan . --format sarif -o complycore.sarif

Languages

JavaScript, TypeScript, JSX, TSX, Python, Go, Java, Kotlin, PHP, Dart / Flutter

Each language has its own lexer, so comments, docstrings, annotations, struct tags, Kotlin and Dart string templates, PHP "$var" and "{$obj->prop}" interpolation, and raw strings are understood rather than pattern-matched. On the JVM the rules know Spring (Web, Data, Security), JAX-RS, Ktor and Javalin; JDBC, JPA/Hibernate and Room; RestTemplate, WebClient and OkHttp; SLF4J, Log4j and Android logging; Redis templates, Kafka and RabbitMQ; and the OpenAI, Anthropic, Gemini, Spring AI and LangChain4j SDKs. In PHP they know Laravel (routes, middleware, Eloquent $fillable/$casts, Http, Cache, Log), Symfony attributes and Doctrine, WordPress (REST routes, admin-ajax, $wpdb, transients) and plain PDO/mysqli. In Dart they know Flutter's SharedPreferences versus flutter_secure_storage, Hive, Isar, Drift and sqflite, http and dio, Firebase and the analytics SDKs, and dart_openai, anthropic_sdk_dart and google_generative_ai.

Whole-project scanning

On opening a workspace, ComplyCore scans the whole repository and reports a single figure in the status bar — ComplyCore: 53 risks in ajo-app-backend — taking the project name from package.json. Opening a file adds its detailed, line-level diagnostics.

Team dashboard

Sign in and findings sync to your organisation's dashboard at app.getcomplycore.com: projects register themselves on first scan, admins add developers to projects, and compliance reports are generated per project and per framework. Findings resolve automatically once a scan no longer reports them.

Set complycore.requireAuth to false to scan locally without an account. Nothing leaves your machine in that mode.

Commands

Settings

Settings → ComplyCore

What leaves your machine

Your source code never does. Analysis runs entirely inside the editor. When you are signed in, ComplyCore sends only the description of each finding:

• the rule that fired, its title, severity and confidence
• the line and column
• the category of data involved (pii, financial, government_id, …) and the sink it reached
• the framework references (NDPR, GDPR, PCI-DSS, and the regional citations for POPIA, Kenya, Ghana and UK GDPR, so a framework you enable later still has history)
• the file path relative to your project, and the project name from package.json

No file contents, no code snippets, no matched text, no variable values. A finding says "a government ID reaches a log at src/kyc.service.ts:988" — never what that line contains. Paths are workspace-relative by design, so your machine's folder structure and account name stay local.

Findings are sent when a file is opened or saved, not on every keystroke (complycore.syncMode). Set complycore.requireAuth to false to scan with no account at all. In that mode nothing is transmitted and no network request is made.

Questions about data handling: support@getcomplycore.com

Scope

Analysis is per-file: a value is traced through assignments, calls and interpolations within a file, not across module boundaries. ComplyCore finds where sensitive data is handled unsafely; it does not prove that data is safe everywhere else.

It complements commit-time tooling rather than replacing it. To block commits containing secrets, add gitleaks or git-secrets.

Support

getcomplycore.com · support@getcomplycore.com