Self-hosted compliance management, no containers
Self-hosted compliance management on ordinary hosting: PHP and a database, no container runtime, and what a register does and does not do.
self-hosted compliance management system is a query with an unusual amount of information in it. The person typing it has a register to keep, has looked at the hosted options, and has decided the records belong on their own server. The word missing from the query, and the one this page is really about, is without containers -- because a great deal of self-hostable software in this category now assumes an orchestration stack that a small organisation has no reason to run.
What a compliance register actually is
Strip the category word away and the thing underneath is modest: a list of events, each with dates attached, each with evidence attached, and an export. A complaint arrives, it is acknowledged inside a window, it moves through states, and at the end somebody can produce a file showing what happened and when.
That shape does not need a cluster. It needs a database, a form, a clock and a permission model. The reason it is usually sold as a monthly subscription is commercial, not technical.
What running it on ordinary hosting changes
Complia and Confida both run on PHP with PDO and either MySQL, MariaDB or SQLite. That is a shared host with mod_rewrite, or a small virtual machine -- no container runtime, no orchestrator, no message queue, nothing to keep alive beside the thing itself. Upgrades are a file replacement and the database migrates itself.
Try the Complia demo ↗Live, on sample data, no sign-up.
The practical consequences are worth naming. The register survives the person who set it up, because what they set up is a PHP application on a host the organisation pays for, not a stack only they understood. There is no per-seat meter, so adding a second handler is free. And the audit export is a CSV you generate yourself, hardened against spreadsheet formula injection, rather than a support request to a vendor.
What to look for
A window that is a setting, not a constant. Complia's acknowledgement timer is configurable, and its default sits one day inside the commonly cited thirty. A hardcoded statutory number in someone else's software is a liability, because statutes are amended and code is not.
Clocks that respect your calendar. Confida tracks the Directive's acknowledgement and feedback windows per report and counts them against your own working calendar rather than a naive calendar month.
An append-only trail. A register whose history can be edited is a diary, not a record. Both products keep an audit log alongside the case, and both export it.
Evidence handled carefully. Confida accepts photographs only, strips their metadata to pixels, and refuses documents outright, because a document's author metadata cannot be reliably removed. A product that accepted anything would be quietly leaking identities.
A public side that is genuinely public. A complaint form and a status page a member of the public can use, with a tracking link that opens their own case, and nothing that makes them create an account.
The limits, stated plainly
Neither product is legal advice, and neither makes an organisation anything. They record; the judgement stays with you and your advisers. Complia's own limits page says so in as many words.
Complia has no deadline approaching reminder: a date passing is not an event it observes, and watching for one would take a background job it does not run. It is not a case-management suite -- no assignments, no escalation ladder, no billing. The interface is English only. Confida has no supervisory-authority filing and no telephone or voice intake: it is a written channel, and the meeting a reporter may ask for is a process you run rather than software you install. Both run one organisation per installation.
If you want the wider set rather than one register, the Compliance Suite is the same products bought together; the suite page carries the current figures and their date.
Questions people ask
Does any of this involve Docker or Kubernetes? No. It is PHP with PDO and a database. Shared hosting with mod_rewrite, or a small virtual machine, and the upgrade path is replacing the files.
Does buying a register change an organisation's position under any statute? No, and neither product claims it does. A register keeps the record; what the record means is outside the software.
Can the whole history be exported? Yes. Both carry an audit CSV export, hardened against spreadsheet formula injection, and a one-click database backup from admin.
Where to look next
The product pages are Complia for complaints and Confida for a whistleblowing channel, each with its own feature record and its own stated limits, and the Compliance Suite holds the set. For what the hosted compliance platforms charge, read the observatory: every figure is quoted verbatim beside the date it was read and a link to the page it came from, and a vendor that publishes no price at all is recorded as publishing none. Prices are on the observatory; read them on the date shown there.