{ "meta": { "attribution": "Anchor Terminal (https://www.anchorterminal.com)", "docs": "https://www.anchorterminal.com/docs/", "generatedAt": "2026-10-08", "license": "CC-BY-4.0", "method": "https://www.anchorterminal.com/benchmark/", "methodology": "0.4", "openapi": "https://www.anchorterminal.com/openapi.json", "preview": false, "run": "2026-10-01", "runLabel": "October 2026 research run" }, "tool": { "slug": "complyadvantage", "name": "ComplyAdvantage", "vendor": "IVXS UK Limited (trading as ComplyAdvantage)", "vendorUrl": "https://complyadvantage.com", "kind": "http-api", "category": "identity-verification", "summary": "ComplyAdvantage screens people and companies against sanctions lists, watchlists, politically exposed person registers and adverse media, with ongoing monitoring and case management. Agents reach its Mesh platform through a REST API with a public OpenAPI spec.", "url": "https://www.anchorterminal.com/tools/complyadvantage", "markdownUrl": "https://www.anchorterminal.com/tools/complyadvantage.md", "slimMarkdownUrl": "https://www.anchorterminal.com/tools/complyadvantage.min.md", "jsonUrl": "https://www.anchorterminal.com/api/v1/tools/complyadvantage.json", "license": "Proprietary service. No service agreement is published, and the terms page on complyadvantage.com covers the website only", "transports": [ "http" ], "remoteUrl": "https://api.mesh.complyadvantage.com", "packages": [], "auth": "oauth", "authNotes": "The Mesh API uses the OAuth2 client credentials flow. A Mesh admin, or a custom role with the API credential permissions, creates a credential in the web application under Settings, Access Management, API Credentials, choosing its permissions and an optional expiry date. The integration sends the access key and secret to `POST /v3/token` and receives a bearer token valid for 24 hours, with no refresh. A credential can't be edited, its secret is shown once, and deactivating it invalidates tokens already issued. The older username and password flow at `POST /v2/token` remains supported for existing integrations. Accounts are opened by ComplyAdvantage after a Starter Plan purchase or a sales contract, so there is no self-serve key (https://docs.mesh.complyadvantage.com/docs/getting-started, https://support.complyadvantage.com/articles/5045588818-creating-api-credentials, checked 2026-10-08).", "pricing": "paid", "pricingNotes": "The Starter Plan is priced by monitored entities a month. Essentials runs from $119 a month for up to 100 entities to $383 for up to 2,000 on monthly billing ($99 to $319 on annual billing), and the Agentic version from $179 to $575. Entities over the allowance are charged at 1.5 times the unit rate. Enterprise, which adds transaction monitoring and payment screening, is priced on application. No free tier or trial was found. Sandbox and production logins come with a paid account, set up by staff within one working day, and the pricing page says the API is included. ComplyLaunch gives early-stage start-ups free access on application (https://complyadvantage.com/pricing/, https://complyadvantage.com/starter-plan/, checked 2026-10-08).", "priceSummary": "$119 / mo", "where": "hosted", "x402": { "level": "no", "evidence": "No x402, MPP or L402 in the Mesh API docs, the OpenAPI spec or the pricing pages (checked 2026-10-08).", "endpoints": [] }, "toolCount": null, "popularity": { "githubStars": null, "npmWeekly": null, "pypiWeekly": null, "asOf": "2026-10-08" }, "docsUrl": "https://docs.mesh.complyadvantage.com", "llmsTxt": "https://docs.mesh.complyadvantage.com/llms.txt", "openapi": "https://docs.mesh.complyadvantage.com/openapi/mesh-api.json", "capabilities": [ "kyc.screening", "kyc.cases" ], "tags": [ "hosted", "paid", "sandbox", "oauth", "openapi", "llms-txt", "webhooks", "aml", "sanctions", "audit-log", "iso27001", "soc2" ], "lastRelease": "2026-09-16", "graded": true, "anchor": { "graded": true, "score": 52.6, "grade": "D", "agentReady": false, "rank": 564, "ranked": true, "rankOf": 722, "categoryRank": 9, "methodology": "0.4", "run": "2026-10-01", "scores": { "ergonomics": 67, "maintenance": 28, "payments": 10, "reliability": 42, "schema": 82, "security": 68, "transparency": 50 }, "pending": [ "performance", "tasks" ], "breakdown": [ { "key": "reliability", "name": "Reliability", "weight": 16, "effectiveWeight": 20, "score": 42, "points": 8.4, "reason": "Graded on the Mesh REST API, hosted lines. No public status page was found. status.complyadvantage.com does not resolve and none is linked from the site, the docs or the help centre (0). No readable incident history (5). Default limits published as 1,000 requests a minute in production and 300 in Sandbox (15). `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` headers are documented, an idempotency key header exists on the rescreen workflow and two workflows are described as safe to resend, but the Mesh docs give no backoff guidance (12). No SLA found in public (0). The API is generally available (10)." }, { "key": "performance", "name": "Performance", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Latency is measured per call by our probes, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until the first probe window closes." }, { "key": "schema", "name": "Schema \u0026 documentation", "weight": 13, "effectiveWeight": 16.25, "score": 82, "points": 13.33, "reason": "Public OpenAPI 3.0.3 spec with 165 operations on 124 paths (25). `llms.txt` and every docs page as Markdown (10). All 165 operations carry a summary and description, 124 name the permission needed, and some say when to use another endpoint, such as exports above 10,000 customers (15). 949 schemas with 441 enums and 682 required lists (13). 1,361 examples and an errors guide with a body for each status, though 429 is not declared on operations (12). A versioning policy and `/v2` and `/v3` paths, but no changelog was found (7)." }, { "key": "ergonomics", "name": "Agent ergonomics", "weight": 13, "effectiveWeight": 16.25, "score": 67, "points": 10.89, "reason": "List responses are partial records sized with `page_size`. No field selection was found (15). `page_number`, `page_size`, attribute, range and substring filters and `sort` on 48 operations, described as most list endpoints (18). Errors follow one structure with title, status, detail, an identifier and a timestamp (16). `X-ComplyAdvantage-Idempotency-Key` on one operation, two workflows described as idempotent, and 409 on concurrent requests for one external identifier (12). No official SDK was found, and a token must be fetched every 24 hours. A Postman collection is published (6)." }, { "key": "security", "name": "Security \u0026 auth", "weight": 14, "effectiveWeight": 17.5, "score": 68, "points": 11.9, "reason": "OAuth2 client credentials with per-credential permissions, optional expiry, 24-hour tokens and deactivation that invalidates issued tokens. Credentials can't be edited, and the older username and password token flow is still supported (28). View and manage permissions are separate and a creator can only grant permissions they hold. No confirmation step for deletes was found (14). Results include third-party adverse media text and customer-supplied data. No injection guidance was found (3). Audit log endpoints for the account, cases, customers, roles, transactions and users (14). ISO 27001 and SOC 2 are stated in the vendor's own article of January 2025, with CREST penetration testing. No security.txt, disclosure policy, bug bounty or trust centre was found (9). No deduction for the older API accepting a key in the query string, because the graded Mesh API takes the token in a header only." }, { "key": "payments", "name": "Payments \u0026 pricing", "weight": 10, "effectiveWeight": 12.5, "score": 10, "points": 1.25, "reason": "No x402, MPP or L402 (0). Starter Plan prices are public by monitored-entity tier, from $119 a month, and Enterprise is priced on application. No per-call price (10). No free tier or trial was found. Sandbox comes with a paid account, and ComplyLaunch is free only to start-ups accepted on application (0). A person buys the plan and staff set the account up within a working day (0)." }, { "key": "tasks", "name": "Task success", "weight": 10, "effectiveWeight": 0, "pending": true, "points": 0, "reason": "Pending. Task success needs the category task suites run through each tool, which haven't run yet, so this run doesn't score it. Its weight is shared across the assessed categories until then. A data provider's data-quality score is published on its listing now and becomes half of this category when it's scored." }, { "key": "maintenance", "name": "Maintenance \u0026 community", "weight": 7, "effectiveWeight": 8.75, "score": 28, "points": 2.45, "reason": "No changelog or release notes were found, so dates come from docs page timestamps. The getting started guide was updated on 16 September 2026, the rate limiting guide on 28 August and the `/v3/token` reference on 12 August. Scored as within 90 days because a page edit is weaker evidence than a release (20). No dated changelog entries (0). Support by email and a ticket portal, with a help centre whose credential article was updated in September 2026. No public community channel found (5). No official SDK (0). The OpenAPI spec and Postman collection are current with the reference pages (3)." }, { "key": "transparency", "name": "Transparency \u0026 trust", "weight": 7, "effectiveWeight": 8.75, "score": 50, "points": 4.38, "note": "editorial 40, provenance 59", "reason": "Closed service. The only public terms cover the website, and no service agreement or API terms were found (8). The privacy notice of 12 June 2026 sets out controller and processor roles, transfer safeguards and 30-day backup retention for removed database entries. No public data processing agreement or retention period for customers' screening data was found (14). A versioning policy lists what counts as backwards compatible, the older API's 2018 deprecation gave two years' notice with dates, and the Mesh spec marks 5 operations deprecated without dates (10). Six regional API hosts are named in the webhooks guide. No subprocessor list was found (8)." } ], "assessment": { "date": "2026-10-08", "basis": "public evidence", "confidence": "medium", "notes": { "ergonomics": "List responses are partial records sized with `page_size`. No field selection was found (15). `page_number`, `page_size`, attribute, range and substring filters and `sort` on 48 operations, described as most list endpoints (18). Errors follow one structure with title, status, detail, an identifier and a timestamp (16). `X-ComplyAdvantage-Idempotency-Key` on one operation, two workflows described as idempotent, and 409 on concurrent requests for one external identifier (12). No official SDK was found, and a token must be fetched every 24 hours. A Postman collection is published (6).", "maintenance": "No changelog or release notes were found, so dates come from docs page timestamps. The getting started guide was updated on 16 September 2026, the rate limiting guide on 28 August and the `/v3/token` reference on 12 August. Scored as within 90 days because a page edit is weaker evidence than a release (20). No dated changelog entries (0). Support by email and a ticket portal, with a help centre whose credential article was updated in September 2026. No public community channel found (5). No official SDK (0). The OpenAPI spec and Postman collection are current with the reference pages (3).", "payments": "No x402, MPP or L402 (0). Starter Plan prices are public by monitored-entity tier, from $119 a month, and Enterprise is priced on application. No per-call price (10). No free tier or trial was found. Sandbox comes with a paid account, and ComplyLaunch is free only to start-ups accepted on application (0). A person buys the plan and staff set the account up within a working day (0).", "reliability": "Graded on the Mesh REST API, hosted lines. No public status page was found. status.complyadvantage.com does not resolve and none is linked from the site, the docs or the help centre (0). No readable incident history (5). Default limits published as 1,000 requests a minute in production and 300 in Sandbox (15). `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` headers are documented, an idempotency key header exists on the rescreen workflow and two workflows are described as safe to resend, but the Mesh docs give no backoff guidance (12). No SLA found in public (0). The API is generally available (10).", "schema": "Public OpenAPI 3.0.3 spec with 165 operations on 124 paths (25). `llms.txt` and every docs page as Markdown (10). All 165 operations carry a summary and description, 124 name the permission needed, and some say when to use another endpoint, such as exports above 10,000 customers (15). 949 schemas with 441 enums and 682 required lists (13). 1,361 examples and an errors guide with a body for each status, though 429 is not declared on operations (12). A versioning policy and `/v2` and `/v3` paths, but no changelog was found (7).", "security": "OAuth2 client credentials with per-credential permissions, optional expiry, 24-hour tokens and deactivation that invalidates issued tokens. Credentials can't be edited, and the older username and password token flow is still supported (28). View and manage permissions are separate and a creator can only grant permissions they hold. No confirmation step for deletes was found (14). Results include third-party adverse media text and customer-supplied data. No injection guidance was found (3). Audit log endpoints for the account, cases, customers, roles, transactions and users (14). ISO 27001 and SOC 2 are stated in the vendor's own article of January 2025, with CREST penetration testing. No security.txt, disclosure policy, bug bounty or trust centre was found (9). No deduction for the older API accepting a key in the query string, because the graded Mesh API takes the token in a header only.", "transparency": "Closed service. The only public terms cover the website, and no service agreement or API terms were found (8). The privacy notice of 12 June 2026 sets out controller and processor roles, transfer safeguards and 30-day backup retention for removed database entries. No public data processing agreement or retention period for customers' screening data was found (14). A versioning policy lists what counts as backwards compatible, the older API's 2018 deprecation gave two years' notice with dates, and the Mesh spec marks 5 operations deprecated without dates (10). Six regional API hosts are named in the webhooks guide. No subprocessor list was found (8)." }, "sources": [ { "what": "Mesh docs index for agents", "url": "https://docs.mesh.complyadvantage.com/llms.txt", "seen": "2026-10-08" }, { "what": "Mesh OpenAPI spec", "url": "https://docs.mesh.complyadvantage.com/openapi/mesh-api.json", "seen": "2026-10-08" }, { "what": "getting started and authentication", "url": "https://docs.mesh.complyadvantage.com/docs/getting-started.md", "seen": "2026-10-08" }, { "what": "API access token reference", "url": "https://docs.mesh.complyadvantage.com/reference/createtokenv3.md", "seen": "2026-10-08" }, { "what": "rate limiting", "url": "https://docs.mesh.complyadvantage.com/docs/rate-limiting.md", "seen": "2026-10-08" }, { "what": "errors", "url": "https://docs.mesh.complyadvantage.com/docs/errors.md", "seen": "2026-10-08" }, { "what": "versioning", "url": "https://docs.mesh.complyadvantage.com/docs/versioning.md", "seen": "2026-10-08" }, { "what": "working with lists", "url": "https://docs.mesh.complyadvantage.com/docs/working-with-lists.md", "seen": "2026-10-08" }, { "what": "webhooks and regional hosts", "url": "https://docs.mesh.complyadvantage.com/docs/webhooks.md", "seen": "2026-10-08" }, { "what": "upgrade guide from the older API", "url": "https://docs.mesh.complyadvantage.com/page/authentication.md", "seen": "2026-10-08" }, { "what": "older API reference", "url": "https://docs.complyadvantage.com/", "seen": "2026-10-08" }, { "what": "creating API credentials", "url": "https://support.complyadvantage.com/articles/5045588818-creating-api-credentials", "seen": "2026-10-08" }, { "what": "how to contact support", "url": "https://support.complyadvantage.com/articles/5261580702-how-to-contact-support", "seen": "2026-10-08" }, { "what": "pricing", "url": "https://complyadvantage.com/pricing/", "seen": "2026-10-08" }, { "what": "Starter Plan prices", "url": "https://complyadvantage.com/starter-plan/", "seen": "2026-10-08" }, { "what": "website terms and conditions", "url": "https://complyadvantage.com/terms-and-conditions/", "seen": "2026-10-08" }, { "what": "privacy notice", "url": "https://complyadvantage.com/privacy-notice/", "seen": "2026-10-08" }, { "what": "Mesh security and privacy article", "url": "https://complyadvantage.com/insights/data-privacy-and-security-essentials-in-complyadvantage-mesh/", "seen": "2026-10-08" }, { "what": "security.txt, 404", "url": "https://complyadvantage.com/.well-known/security.txt", "seen": "2026-10-08" }, { "what": "domain registration", "url": "https://rdap.verisign.com/com/v1/domain/complyadvantage.com", "seen": "2026-10-08" } ], "openQuestions": [ "The lead's docs link, docs.complyadvantage.com, is the older API. New integrations are documented on Mesh at docs.mesh.complyadvantage.com, which is the surface graded. The 300 calls a minute Sandbox limit holds for both.", "Whether new customers can still be given the older API was not established.", "No status page was found. A private or customer-only page may exist.", "No service agreement, API terms, data processing agreement, SLA or subprocessor list was found in public, so `provenance.terms` is left out.", "unchecked: the Starter Plan checkout page at https://complyadvantage.com/checkout/ is drawn by script, so any terms linked from it were not read.", "unchecked: the Mesh web application and support portal need a login, so credential permission names and any in-app release notes were not read.", "No official SDK was found in the docs. Package registries were not searched for unofficial clients.", "ISO 27001 and SOC 2 rest on the vendor's own article of 21 January 2025. No certificate or report was seen." ] }, "negative": 0, "verdict": "The Mesh API has a public OpenAPI 3.0.3 spec with 165 described operations, per-credential permissions and audit log endpoints, which suits an agent screening customers and working alerts. No status page, changelog, SDK, service agreement or subprocessor list was found in public, and access starts with a paid plan bought by a person.", "bestFor": "An agent that screens customers and companies against sanctions, politically exposed person and adverse media data, keeps them under monitoring and works the resulting alerts and cases.", "strengths": [ "Public OpenAPI 3.0.3 spec with 165 operations, each with a summary and description, and 124 naming the permission the call needs", "API credentials carry their own permissions and optional expiry, and deactivation invalidates tokens already issued", "Six audit log endpoints cover the account, cases, customers, roles, transactions and users", "Rate limits are published (1,000 requests a minute in production, 300 in Sandbox) with `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` headers", "`llms.txt` on the docs site, and every guide and reference page is served as Markdown" ], "weaknesses": [ "No public status page or incident history was found. `status.complyadvantage.com` does not resolve", "No changelog or release notes were found for the Mesh API", "No service agreement, data processing agreement or subprocessor list is published. The terms page covers the website only", "No free tier or self-serve trial. The Starter Plan starts at $119 a month and accounts are set up by staff within a working day", "No official SDK was found. Access tokens last 24 hours with no refresh", "Screening results carry third-party adverse media text, and no prompt-injection guidance was found" ], "agentNotes": [ "Exchange the access key and secret at `POST /v3/token` for a bearer token. It lasts 24 hours and can't be refreshed, so request a new one before expiry", "Ask for a credential with only the permissions the task needs. Permissions can't be edited later, and each reference page names the ones a call requires", "Create a screening configuration first and keep its `configuration_identifier`. Creating and screening a customer needs it", "Give each customer a unique external identifier. A concurrent request for the same identifier returns 409 with a pointer to the first workflow", "Read `Ratelimit-Remaining` and `Ratelimit-Reset` on every response. A 429 body is only `API rate limit exceeded`" ], "metrics": { "kind": "remote", "measured": false }, "reviewCount": 0, "avgRating": 0, "history": [ { "basis": "public evidence", "confidence": "medium", "grade": "D", "methodology": "0.4", "pending": [ "performance", "tasks" ], "run": "2026-10-01", "runLabel": "October 2026 research run", "score": 52.6 } ], "editorialScores": { "ergonomics": 67, "maintenance": 28, "payments": 10, "reliability": 42, "schema": 82, "security": 68, "transparency": 40 }, "provenanceScore": 59 }, "connect": { "http": "curl -X POST https://api.mesh.complyadvantage.com/v3/token \\\n -H 'Content-Type: application/json' \\\n -d '{\"access_key\": \"\u003cyour access key\u003e\", \"secret\": \"\u003cyour secret\u003e\"}'" }, "letme": { "capability": "https://letme.dev/kyc.screening", "tool": "https://letme.dev/complyadvantage" }, "notable": [ "ComplyAdvantage documents two APIs. The Mesh API at docs.mesh.complyadvantage.com is the current platform, and the older API at docs.complyadvantage.com (key in an `Authorization: Token` header, `POST /searches`) remains documented, with an upgrade guide to Mesh (https://docs.mesh.complyadvantage.com/page/mesh-upgrade-guide)", "The Mesh OpenAPI 3.0.3 spec lists 165 operations on 124 paths, covering customers, screening configurations, cases, alerts and risks, transactions, payment screening, custom lists, webhooks, users, roles and audit logs (https://docs.mesh.complyadvantage.com/openapi/mesh-api.json)", "Default rate limits are 1,000 requests a minute for production accounts and 300 for Sandbox accounts, with `Ratelimit-Limit`, `Ratelimit-Remaining` and `Ratelimit-Reset` response headers (https://docs.mesh.complyadvantage.com/docs/rate-limiting)", "Webhooks are delivered at least once with a stable `webhook-id` header and three retries after 1, 5 and 10 seconds. HMAC-SHA256 signing is opt-in per account through support (https://docs.mesh.complyadvantage.com/docs/webhooks)", "The docs site answers at `/mcp` with a message that the URL is for MCP clients. This is the documentation host's server for reading the docs. No MCP server for the product itself was found (https://docs.mesh.complyadvantage.com/mcp)", "The Agentic Starter Plan adds two vendor-run agents, Cassie for onboarding cases and Otto for monitoring cases, which act on cases a person assigns to them (https://complyadvantage.com/starter-plan/)" ], "area": "domain-data", "details": [ { "label": "API", "value": "Mesh REST API, OpenAPI 3.0.3 titled Mesh API v2.0, 165 operations on 124 paths (84 GET, 47 POST, 14 PATCH, 10 PUT, 10 DELETE) under `/v2` and `/v3`. Server in the spec is https://api.mesh.complyadvantage.com" }, { "label": "Regions", "value": "The webhooks guide names six regional hosts, api.eu, api.eu3, api.us, api.us2, api.ca and api.au under mesh.complyadvantage.com. Support confirms which one an account is on" }, { "label": "Screening", "value": "`POST /v2/workflows/sync/create-and-screen` creates a customer, scores risk, screens against sanctions, watchlists, politically exposed persons and adverse media, and raises alerts and cases. An asynchronous version and a rescreen workflow also exist" }, { "label": "Credentials", "value": "Access key and secret per integration with chosen permissions and optional expiry, exchanged for a 24-hour bearer token at `POST /v3/token`. Not editable. Deactivation is permanent and invalidates issued tokens" }, { "label": "Rate limits", "value": "1,000 requests a minute in production and 300 in Sandbox by default, set per account. 429 returns `API rate limit exceeded`" }, { "label": "Lists", "value": "`page_number` and `page_size` (default 50 on customers), attribute, range and substring filters, and `sort` with a minus sign for descending. The customers list returns at most 10,000 records, with exports for more" }, { "label": "Idempotency", "value": "`X-ComplyAdvantage-Idempotency-Key` header on the rescreen workflow. Create-and-screen and update-and-rescore are described as idempotent on resending the same request" }, { "label": "Audit", "value": "`GET /v2/audit/...` for the account, cases, customers, roles, transactions and users" }, { "label": "Older API", "value": "docs.complyadvantage.com documents the earlier search API at api.complyadvantage.com (EU), api.us and api.ap, limited to 600 calls a minute on a standard contract and 300 in Sandbox, with exponential backoff guidance for 429" }, { "label": "Status", "value": "No public status page found. Outages are reported to support by email" }, { "label": "Certifications", "value": "ComplyAdvantage's own article of 21 January 2025 lists ISO 27001 and SOC 2 for Mesh. No trust centre or public report was found" }, { "label": "Data handling", "value": "The privacy notice of 12 June 2026 says ComplyAdvantage is controller of its screening database and processor or sub-processor when screening a client's customer data. No public data processing agreement or subprocessor list was found" } ], "unitPrices": [ { "item": "Essentials Starter Plan, up to 100 monitored entities", "unit": "month", "usd": 119, "note": "monthly billing; $99 a month on annual billing" }, { "item": "Essentials Starter Plan, up to 1,000 monitored entities", "unit": "month", "usd": 323, "note": "monthly billing; $269 a month on annual billing" }, { "item": "Essentials Starter Plan, up to 2,000 monitored entities", "unit": "month", "usd": 383, "note": "monthly billing; $319 a month on annual billing" }, { "item": "Agentic Starter Plan, up to 100 monitored entities", "unit": "month", "usd": 179, "note": "monthly billing; $149 a month on annual billing" } ], "provenance": { "legalEntity": "IVXS UK Limited (trading as ComplyAdvantage)", "domain": "complyadvantage.com", "domainRegistered": "2014-07-05", "endpointOnVendorDomain": true, "terms": "", "privacy": "https://complyadvantage.com/privacy-notice/", "statusPage": "", "changelog": "", "securityTxt": "none", "checked": "2026-10-08", "notes": [ "The privacy notice (last updated 12 June 2026) names IVXS UK Limited, trading as ComplyAdvantage, 86-90 Paul Street, London EC2A 4NE, registered with the UK Information Commissioner under ZA054290, and covers its products and services as well as the website.", "No `terms` is given. https://complyadvantage.com/terms-and-conditions/ is the website's terms of use, and no service agreement, API terms or data processing agreement was found on the site, the docs or the help centre.", "The Mesh API answers at api.mesh.complyadvantage.com and regional hosts under mesh.complyadvantage.com.", "https://complyadvantage.com/.well-known/security.txt and /security.txt return 404.", "status.complyadvantage.com does not resolve, and no status page is linked from the site, the docs or the help centre. docs.mesh.complyadvantage.com/changelog returns 404.", "RDAP for complyadvantage.com gives a registration date of 2014-07-05." ], "score": 59, "checks": [ { "check": "Legal entity named", "value": "IVXS UK Limited (trading as ComplyAdvantage)", "points": 20, "max": 20, "state": "ok" }, { "check": "Domain age", "value": "complyadvantage.com, registered 2014-07-05 (12 years)", "points": 15, "max": 15, "state": "ok" }, { "check": "Endpoint on the vendor's domain", "value": "api.mesh.complyadvantage.com", "points": 15, "max": 15, "state": "ok" }, { "check": "Terms of service", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Privacy policy", "value": "read, states 7 of the 8 things a reader expects", "points": 9.3, "max": 10, "state": "part" }, { "check": "Status page", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "Changelog", "value": "not found", "points": 0, "max": 10, "state": "no" }, { "check": "security.txt", "value": "not found", "points": 0, "max": 10, "state": "no" } ], "policies": [ { "kind": "terms", "url": "", "state": "none-found", "points": 0, "max": 10 }, { "kind": "privacy", "url": "https://complyadvantage.com/privacy-notice/", "state": "read", "readAt": "2026-10-08", "statedDate": "2026-06-12", "words": 6193, "points": 9.3, "max": 10, "expected": [ { "key": "privacy.date", "label": "Gives the date it was last updated", "found": true, "quote": "Last updated: 12 June 2026", "says": "Last updated 2026-06-12" }, { "key": "privacy.collected", "label": "Says what personal data is collected", "found": true, "quote": "The expression “User” (and “you”/”your”) in this Privacy Notice shall mean any person accessing the ComplyAdvantage website, using ComplyAdvantage products and services, or about whom we collect and use any information in the course of providing our products and services." }, { "key": "privacy.retention", "label": "Says how long data is kept", "found": true, "quote": "Your information is stored in our applicant tracking system for up to 24 months after you have been notified your application has been unsuccessful.", "says": "Names a period of 24 months" }, { "key": "privacy.processors", "label": "Says who else receives the data", "found": true, "quote": "Government and legal service providers involved in the visa application process," }, { "key": "privacy.sale", "label": "Says whether personal data is sold or shared for advertising", "found": false }, { "key": "privacy.rights", "label": "Says what rights people have over their data", "found": true, "quote": "As a data subject, whose personal data we process, you have the rights described below under the UK GDPR and Data (Use and Access) Act 2025." }, { "key": "privacy.contact", "label": "Gives a privacy contact", "found": true, "quote": "Details of the controller and data protection officer: the controller of the personal data we process is IVXS UK Limited (trading as ComplyAdvantage) (referred to as “ComplyAdvantage”/“we”/“us”), having its registered office at 86-90 Paul Street, London EC2A 4NE and which is registered with the UK Information Commissi…", "says": "Names a data protection officer" }, { "key": "privacy.transfers", "label": "Says where data is transferred or stored", "found": true, "quote": "For transfers from the UK: We comply with the UK GDPR requirements, including UK adequacy regulations where available, or appropriate safeguards such as the UK International Data Transfer Agreement (IDTA) or UK Addendum to EU Standard Contractual Clauses.", "says": "Relies on standard contractual clauses" } ], "notes": [ { "date": "2026-10-08", "text": "Anyone using the services agrees not to use them or the data for any purpose authorised under the US Fair Credit Reporting Act or for adverse action on a consumer application.", "quote": "If you use any of our services, you agree not to use them, or the data, for any purpose authorized under the FCRA or in relation to taking an adverse action relating to a consumer application." } ] } ] }, "pageJsonUrl": "https://www.anchorterminal.com/tools/complyadvantage.json", "live": { "slug": "complyadvantage", "probe": { "target": "https://api.mesh.complyadvantage.com", "method": "get", "lastAt": "2026-10-08T21:12:08.002379051Z", "lastOk": true, "lastStatus": 401, "lastMs": 42, "lastNote": "asks for credentials", "authRequired": true, "uptime24h": 100, "uptime30d": 100, "p50ms24h": 50, "p95ms24h": 91, "samples24h": 21, "samples30d": 21, "days": [ { "date": "2026-10-08", "probes": 21, "ok": 21 } ] }, "updatedAt": "2026-10-08T21:12:08.002379051Z" } } }