It's Complicated was developed during a day and age when people have begun taking the question of data privacy and security seriously. Therefore we haven't had to adapt our platform to GDPR and encryption standards, but have proper security principles built into it from the start. At the core of It's Complicated is an understanding of how important it is to be able to exchange personal thoughts in a private, secure space.
Encryption of conversations
All video calls are powered by Stream, a HIPAA and GDPR compliant provider using WebRTC protocol. No video data is stored on servers. All messages use SSL encryption and are stored securely in GDPR-compliant European data centers with multiple layers of protection. Learn more about video security or message security.
Encryption of transaction data
On our platform, we use SSL certificates to create an encrypted connection between the user and the platform, which ensures that, for example, when you write a message, update a journal, write a note, change your profile or hold a video call, all data will be sent over a secure protocol.
Security of stored data
All stored data is encrypted and stored in our data centers on several different levels. The more barriers and different systems we have created between the outside world and your data, the more secure they are. In addition, all our data is stored on servers in Europe, where our processes are fully compliant with all GDPR rules.
Reporting Security Issues
At It's Complicated, we value the security community's efforts to keep our platform safe. If you've identified a potential security vulnerability, please email security@complicated.life with details of your finding. Include clear steps that help us understand and reproduce the issue, and give us time to investigate and address the vulnerability before public disclosure.
What you can expect from us
We'll acknowledge your report, investigate the issue thoroughly, and recognize researchers who help protect our platform through responsible disclosure.
Out of Scope
The following types of reports are not considered valid security vulnerabilities: automated vulnerability scanner results, social engineering attempts, DOS/DDOS attacks, physical security testing, issues in third-party applications or websites, and missing security headers without demonstrated impact.
Security Acknowledgments
We'd like to thank the following security researchers for their contributions to making It's Complicated more secure:
It's Complicated is not suitable for acute psychological or medical crises or emergency situations.If you are in a serious crisis and need urgent help, please contact a local emergency service or use one of these resources instead.
