Complia
A self-hosted complaints register with an acknowledgement timer and audit export. Ships set up for the UK 30-day duty.
The problem it solves
If someone complains about how you handled their personal data, you have to be able to show three things later: when the complaint arrived, what it said, and what you did about it. Most small organisations run this out of an inbox and a spreadsheet, with no timer, no audit trail, and nothing to put in front of a regulator. The UK now puts a clock on it: from 19 June 2026, section 103 of the Data (Use and Access) Act 2025 requires every UK data controller to give data subjects a way to complain directly, acknowledge each complaint within 30 days, and respond substantively without undue delay. Complia ships configured for that clock, but the window is a setting - the register, intake form and audit export suit any regime that expects a complaints record.
Most small organisations currently handle this in an inbox and a spreadsheet, with no timer, no audit trail, and nothing to show the regulator.
What you get
Public complaint form
A no-login public form you link from your privacy notice; complainants get a private tracking code on submission.
Public status page
Complainants check progress with their tracking code — status only, no personal data exposed.
30-day acknowledgement timer
The admin register shows days-remaining and OVERDUE flags against the statutory acknowledgement window.
Status workflow with audit log
Move complaints through received, acknowledged, investigating, resolved, or rejected, with an append-only, timestamped investigation log per complaint.
Compliance dashboard
See open complaints, acknowledgements due within 7 days, overdue acknowledgements, and resolutions this month.
Audit CSV export
Export the full register, including status history, ready to hand to your DPO or the ICO.
Installable mobile app (PWA)
Add it to a phone or tablet home screen straight from the browser — a full-screen app served from your own server, with no app store involved. Business data is never cached offline, so what you see is always live.
Own It 2.0 — API, 2FA, backups, dark mode
Complia 2.0 adds the 2.0 owner layer. Upgrade by replacing the files — the database migrates itself, and it is still the same one-time purchase.
- REST API with an OpenAPI spec and signed webhooks
- Two-factor sign-in (TOTP)
- Email notifications through your own SMTP
- CSV import with a mandatory dry run
- One-click backups
- Dark mode
Own It 3.0 — works for your AI, not just for you
Your statutory deadlines land in your calendar: a read-only feed of every open acknowledgement deadline, overdue ones saying so in the title, discharged duties dropping out automatically. The statutory-clock page computes overdue and due-soon the moment you look — deliberately a page, not a nightly email that can silently stop.
- MCP endpoint — your AI works under the same guards you face
- Roles with email invitations and a last-admin guard
- Append-only audit trail across browser, API and agent
- Printable PDFs
- Your logo and colours throughout
- Scheduled backups with a guided dry-run restore
- Optional single sign-on (OIDC)
Pricing — one-time, yours forever
- ✔ Full source included — PHP you can read and change
- ✔ No subscription. One payment, yours forever
- ✔ It never phones home
- ✔ Your data stays on your server
No reviews yet — so here is what we offer instead. Every competitor price on our comparison pages is source-linked and dated, and when a vendor’s price won’t load we say so rather than guess. See the sources for yourself →
Screenshots
Honest limitations
- Single-tenant: one organisation, one admin login per installation
- No complainant-facing email: acknowledgements come from your own mailbox and Complia records the timestamps (2.0 notifies YOU on arrival via your own SMTP)
- Not a case-management suite: no attachments, assignments, or SLA escalations
- English-language UI
- A records aid, not legal advice; buying it does not make you compliant
Two-minute web installer; PHP 8+ with MySQL or SQLite, standard shared-hosting compatible; Nginx snippet included.
Covered in these guides
Where your business data physically lives, who can be compelled to hand it over, and what "EU hosting" does and does not buy you. The questions to ask any SaaS vendor, and the case where self-hosting answers all of them at once.
Frequently asked questions
Does this make me DUAA-compliant?
No tool can claim that. Complia implements the record-keeping and acknowledgement mechanics the duty describes; your policies, responses, and legal position are yours. It's a documentation and records aid, not legal advice.
Is the 19 June 2026 deadline real?
The Data (Use and Access) Act 2025 received Royal Assent on 19 June 2025, and the complaints-handling duty in s.103 was set to commence 12 months later. Verify the current commencement position on legislation.gov.uk and ico.org.uk before publishing your own compliance dates.
Will this run on shared hosting?
Yes. Complia requires PHP 8+ with pdo — present on virtually all cPanel/Plesk hosts. Installation takes about two minutes through the web installer.
Can multiple organisations share one install?
No — Complia is single-tenant, one organisation and one admin login per installation. DPOs running logs for multiple clients use one install per client.
Does it send emails automatically?
Not to the complainant — acknowledging them stays in your own mailbox, and Complia records the timestamps. 2.0 does email YOU the moment a complaint arrives, through your own SMTP server, so the 29-day clock never starts unnoticed.