Compliance & Certifications
Independently verified security, privacy, and compliance credentials
Our certifications demonstrate our commitment to the highest standards of security, privacy, and operational excellence. All certifications are maintained through continuous monitoring and regular third-party audits.
Security & Operational Metrics
Active Certifications
Our comprehensive compliance program ensures we meet the most stringent security and privacy requirements across industries and jurisdictions.
SOC 2 Type II
AICPA
System and Organization Controls (SOC) 2 Type II certification demonstrates our commitment to security, availability, processing integrity, confidentiality, and privacy. This independent third-party audit validates our security controls over a 12-month period.
Scope:
- •Security controls and procedures
- •Availability and system uptime
- •Processing integrity
- + 2 more controls
ISO/IEC 27001:2022
International Organization for Standardization
ISO 27001 is the international standard for information security management systems (ISMS). Our certification demonstrates systematic management of sensitive company and customer information based on risk assessment and treatment.
Scope:
- •Information security management system
- •Risk assessment and treatment
- •Asset management
- + 6 more controls
HIPAA Compliance
U.S. Department of Health and Human Services
Full compliance with the Health Insurance Portability and Accountability Act (HIPAA) Privacy Rule, Security Rule, and Breach Notification Rule. Annual third-party audits verify our technical, physical, and administrative safeguards for Protected Health Information (PHI).
Scope:
- •Privacy Rule compliance
- •Security Rule (administrative, physical, technical safeguards)
- •Breach Notification Rule
- + 4 more controls
GDPR Compliance
European Union
Full compliance with the General Data Protection Regulation (GDPR) for processing personal data of EU residents. Our Data Processing Agreements (DPAs), Standard Contractual Clauses (SCCs), and technical measures ensure lawful data transfers and protection.
Scope:
- •Lawful basis for processing
- •Data subject rights (access, rectification, erasure, portability)
- •Data Protection Impact Assessments (DPIA)
- + 4 more controls
FedRAMP Authorized
U.S. General Services Administration
Federal Risk and Authorization Management Program (FedRAMP) Moderate Impact Level authorization. This allows federal agencies to leverage our cloud services with confidence in our security posture, validated by the Joint Authorization Board (JAB).
Scope:
- •325+ security controls (NIST SP 800-53)
- •Continuous monitoring
- •Incident response
- + 4 more controls
PCI DSS Level 1
PCI Security Standards Council
Payment Card Industry Data Security Standard (PCI DSS) Level 1 compliance for organizations processing over 6 million transactions annually. Our infrastructure meets all 12 requirements for protecting cardholder data.
Scope:
- •Secure network architecture
- •Cardholder data protection
- •Vulnerability management
- + 3 more controls
ISO/IEC 27017:2015
International Organization for Standardization
Cloud security standard providing guidelines for information security controls applicable to cloud services. Extends ISO 27001 with cloud-specific controls for both cloud service providers and customers.
Scope:
- •Cloud service provider responsibilities
- •Cloud customer responsibilities
- •Shared responsibility model
- + 3 more controls
ISO/IEC 27018:2019
International Organization for Standardization
Privacy standard for protecting Personally Identifiable Information (PII) in public cloud computing. Establishes commonly accepted control objectives, controls, and guidelines for implementing measures to protect PII.
Scope:
- •PII protection in cloud
- •Consent and choice
- •Purpose legitimacy and specification
- + 5 more controls
ISO/IEC 27701:2019
International Organization for Standardization
Privacy Information Management System (PIMS) standard extending ISO 27001 and ISO 27002 for privacy management. Demonstrates compliance with privacy regulations including GDPR, CCPA, and other global privacy laws.
Scope:
- •Privacy management system
- •PII controller responsibilities
- •PII processor responsibilities
- + 3 more controls
Compliance Documentation
Download compliance reports and documentation for your procurement and security review processes.
Security Whitepaper
Comprehensive overview of our security architecture, controls, and practices.
SOC 2 Type II Report
Executive summary of our SOC 2 Type II audit results (full report under NDA).
Penetration Test Results
Latest quarterly penetration test summary (detailed findings under NDA).
Compliance Matrix
Control mapping across HIPAA, GDPR, SOC 2, ISO 27001, and FedRAMP.
Continuous Compliance Program
24/7 Security Monitoring
Our Security Operations Center (SOC) monitors all systems 24/7/365 using Splunk Enterprise Security. Real-time threat detection, automated incident response, and continuous vulnerability management ensure we maintain our security posture between audits.
Regular Third-Party Audits
We engage qualified independent assessors for annual SOC 2 audits, ISO surveillance audits, HIPAA assessments, and quarterly penetration tests. All findings are remediated promptly with documented corrective action plans.
Workforce Training & Awareness
All personnel complete monthly security awareness training, annual HIPAA training, and role-specific compliance training. Phishing simulations, tabletop exercises, and incident response drills ensure our team remains vigilant.
Policy & Procedure Updates
Our Information Security Management System (ISMS) is reviewed quarterly and updated to reflect changes in regulations, threat landscape, and business operations. All policies are version-controlled and communicated to relevant stakeholders.