Compliance overview
| Framework | Status | Description |
|---|---|---|
| SOC 2 Type II | Compliant | Achieved October 16, 2025 |
| GDPR DPA | Available | Standard contractual clauses available |
| CCPA | Compliant | California Consumer Privacy Act compliant |
| HIPAA BAA | Available | Business Associate Agreement available |
| Retention controls | Available | Configurable data retention policies |
| Data residency | In progress | EU region available upon request |
Control mapping
How our controls map to common security questionnaire areas:
| Area | What we do | Evidence |
|---|---|---|
| Access control | Role-based access with principle of least privilege. MFA available for all users. | On request |
| Encryption | AES-256 at rest, TLS 1.3 in transit. Keys managed via dedicated KMS with rotation. | On request |
| Logging & monitoring | Comprehensive audit trail of user actions. Logs retained for 1 year minimum. | On request |
| Change management | Documented SDLC with code reviews, testing, and approval workflows. | Under NDA |
| Incident response | Documented runbooks with 72-hour breach notification commitment. | On request |
| Vendor management | DPAs with all subprocessors. Regular security assessments of critical vendors. | On request |
| Business continuity | Disaster recovery with < 4 hour RTO. Regular backup testing. | On request |
| Security awareness | Mandatory security training for all employees. Annual refreshers. | Under NDA |
Framework details
SOC 2 Type II
We achieved SOC 2 Type II certification on October 16, 2025. Annual audits verify our security controls.
Achieved
-
Security, Availability, and Confidentiality trust criteria covered
-
Independent third-party auditor verified controls
-
Continuous monitoring and annual recertification
GDPR
We comply with the General Data Protection Regulation for processing personal data of EU residents.
Compliant
-
Data Processing Agreement (DPA) available
-
Right to access, rectification, and erasure supported
-
Data portability enabled
-
Privacy by design principles applied
CCPA
We comply with the California Consumer Privacy Act for California residents.
Compliant
-
Right to know what data is collected
-
Right to delete personal information
-
Right to opt-out of data sales (we do not sell data)
-
Non-discrimination for exercising rights
HIPAA
We offer HIPAA-compliant configurations for healthcare organizations handling protected health information.
Ready
-
Business Associate Agreement (BAA) available
-
Administrative, physical, and technical safeguards
-
Audit controls and access logging
-
Encryption of PHI at rest and in transit