Security · evidence
Security you can verify
We test Complass ourselves, continuously and with documented results. What independent services measure from the outside, you can check yourself with one click.
As of 04.11.2026 · version 2.37
Measured by independent services
These results come from public test services, not from us. Each link shows that service’s current result.
-
Qualys SSL Labs A+
- Only TLS 1.2 and 1.3
- HSTS for one year, including subdomains
- Certificate valid, renewed automatically
-
Mozilla HTTP Observatory A+
- 12/12 tests
- Strict content security policy
- Protection against being embedded in other sites
- Secure cookies
-
security.txt per RFC 9116 present
- Fixed contact for security reports
- Valid until 28.09.2027
- German and English
The grades show our status as of 04.11.2026. The services measure publicly reachable properties of our website. They do not work on our behalf and do not award a seal.
Our own checks
We test ourselves, with our own tools and without outside consultants. We say this openly, because it means: we do not test once a year, but with every change.
-
OWASP ASVS 5.0 Level 1 to 3 · self-assessment
- Level 1
- 98 % Level 2
- 88 % Level 3
Each requirement assessed against the code and operations. We only call a level met once everything is implemented.
Justified exceptions (not counted as met)
-
Validity of app codes (V6.5.5, Level 2): a code is valid for up to 60 instead of 30 seconds, one time step of grace for codes that expire while being typed.
Why?
An app code changes every 30 seconds. If it expired while someone was typing it, the sign-in used to be refused. We therefore also accept the immediately preceding code, as the RFC 6238 standard provides. Each code can still be used only once, and the sign-in is blocked after a few failed attempts.
-
Key length of third parties (V11.2.3, Level 2): RSA-2048 from identity providers and passkey devices – permitted under NIST SP 800-131A until the end of 2030.
Why?
Complass itself encrypts throughout with at least 128 bits of security (256-bit keys). Identity providers such as Microsoft or Google and many passkey devices, however, sign with RSA-2048 (112 bits). We accept these keys in line with NIST SP 800-131A until the end of 2030; from 2031 we require at least RSA-3072. If we rejected RSA-2048 today, signing in with SSO and passkeys would no longer be possible.
-
Secret keys without a separate key vault (V13.3.1, Level 2): stored as encrypted files on a dedicated data partition instead of in a vault service.
Why?
Secret keys are stored encrypted on a dedicated data partition, readable only by the two services that need them. On a single server, a separate key vault adds no further protection.
-
Automatic scans with every change
- Static code analysis
- Search for accidentally committed credentials
- All third-party components checked for known vulnerabilities
- Software bill of materials (SBOM)
- Dynamic scan of the running application
-
Own penetration test automated
We deliberately attack the platform in a test environment with demo data: tenant separation, permissions, sign-in and inputs.
Latest test: release 2.06, October 2026
- No critical or high findings
- 1 medium and 5 low findings, all fixed before the release and retested
-
Review of every new feature before every release
- Permissions
- Tenant separation
- Input handling
12,000+ automated tests block every release if even one of them fails.
What is OWASP ASVS, and what do levels 1, 2 and 3 mean?
The standard
The Application Security Verification Standard (ASVS) is an open verification standard from the non-profit OWASP Foundation. In several hundred individual requirements it sets out what a secure web application must do: from sign-in, sessions and permissions to input handling, encryption and logging. The current version 5.0 was published in 2025.
The three levels
- Level 1
- Baseline protection against obvious attacks that are easy to exploit. The minimum for every application.
- Level 2
- The standard for applications with sensitive or business-critical data, such as personal data or information security records. Builds on level 1.
- Level 3
- The highest level, for especially critical systems. Builds on level 2.
Where we stand
OWASP ASVS 5.0: Level 1 fully implemented · Level 2 98 % · Level 3 88 % (self-assessment, as of 04.11.2026). Plus an automated penetration test on 24.10.2026. Three justified exceptions, shown openly. How we count
We have assessed every level 1 and level 2 requirement individually against the code and the operation of Complass, and recorded evidence for each requirement. We repeat the full assessment for every major version; with every release we re-check the requirements it affects.
We meet the OWASP ASVS Level 2 security standard except for a few exceptions that we disclose openly. Where it adds protection for your data, we also meet requirements of the highest level, Level 3. These include passkeys for the Complass team, a test of tenant isolation across every route and a log of API read access.
What it is not
Not a certificate: OWASP does not issue certificates and does not test applications itself. Our statement is a self-assessment by Complass.
Customers and prospects receive the detailed mapping per requirement, with implementation, evidence and verification steps, in our security dossier after concluding a non-disclosure agreement. Write to us at info@complass.eu, subject “Sicherheitsdossier” (security dossier).
Results at a glance
We publish a short summary. We do not name individual findings publicly, so nobody can exploit them.
- No open critical findings – across all checks up to 04.11.2026
- Every check documented – with date, time and the state checked, even without a finding
- Hosted in Germany – servers of Hetzner Online GmbH
- AI fill-in assistant only on request – off by default, processed by Amazon Web Services in the Frankfurt region (Germany), without training on your data
- Deletion reaches the backups too – own backup key per customer, destroyed with the deletion
Security notices
There are no published security notices at present. Report vulnerabilities to security@complass.eu (see security.txt).
How we test
All statements on this page are based on our own checks or on public test services. Complass is not certified by an external body.
| Type of check | Who tests | Cadence |
|---|---|---|
| Assessment per OWASP ASVS 5.0 | Complass, self-assessment | Fully per major version, affected requirements per release |
| Static and dynamic scans | Complass, automated | With every change to the code |
| Own penetration test | Complass, test environment with demo data | Latest: release 2.06, October 2026 |
| TLS, headers, security.txt | Public test services | After every release, always verifiable yourself |
Request the security report and the security dossier
Two documents, depending on how deep your review goes.
-
Security report no NDA
For your vendor assessment: answers to the usual questions of a security questionnaire, issued to your company.
Request security report -
Dossier and pentest report under NDA
For audits and technical reviews: every security control with implementation, evidence and verification steps. Plus the report of the latest penetration test (release 2.06, October 2026) with every finding in detail.
After concluding a non-disclosure agreement.
Ask for the dossier and pentest report
Or by email to info@complass.eu.
Found a security vulnerability? Write to security@complass.eu. Notes on reporting are in our security.txt.