Trust Center
How we protect your data, and where our audits stand.
GingerControl works with product, sourcing and import data that importers treat as confidential. This Trust Center sets out the controls in place today, where our audits stand, and how your security team can get the documents it needs.
Compliance
Status of each audit, stated as it is today.
SOC 2
Auditor engagedSecurity, Availability and Confidentiality criteria. We signed an engagement letter with a CPA firm in October 2026. Fieldwork has not started.
ISO/IEC 27001:2022
Contract signedCertification of our information security management system. We signed a certification contract in October 2026. The Stage 1 audit is not yet scheduled.
SOC 2 Type 2
PlannedFollows our first SOC 2 report, covering how controls operate over time.
Compliance automation
ActiveOur controls are tracked in Sprinto, which runs automated checks against both standards.
We do not describe either standard as held until the report or certificate is issued. When that changes, this page changes with it.
Controls
71 controls in place1 planned2 audits engaged
Infrastructure security
15 controls- Production hosted on AWS in the United States
- Database network access restricted
- Firewall rules reviewed
- Audit logging in every AWS region
Data protection
15 controls- Encryption at rest
- Encryption in transit
- Encryption standard documented
- No training on customer data
Access control
7 controls- Two-step verification on company accounts
- Two-factor authentication for source code
- Access reviews
- Administrative access limited
Application security
8 controls- Peer-reviewed code changes
- Secure development lifecycle
- Private source code
- Dependency scanning
People security
11 controls- Policies acknowledged
- Security awareness training
- Code of conduct
- Acceptable use acknowledged
Governance and continuity
16 controls- Information security policy set
- System description maintained
- Information security management system
- Risk management program
AI and your data
Read moreIs our data used to train AI models?
No. We never use customer data to train AI models.
Where is it stored?
Application and primary database: AWS, United States (us-west-2). Uploaded files: Google Cloud Storage, EU. Search index: Elastic Cloud, United States.
Which AI models process it?
Commercial models from OpenAI, Anthropic and Google, called through their APIs.
Documents
View all- SOC 2 reportOnce issued
- ISO/IEC 27001:2022 certificateOnce issued
- Information Security PolicyUnder NDA
- System DescriptionUnder NDA
- Vulnerability assessment summaryUnder NDA
Subprocessors
View listAmazon Web Services, Google Cloud, Vercel, GitHub, OpenAI, Anthropic, Elastic, Stripe, Supabase, Google Workspace.
Updates
- Signed engagements for a SOC 2 examination and ISO/IEC 27001:2022 certification.
- Completed an internal vulnerability assessment of our web application, our two main APIs, and our AWS and Google Cloud accounts.
- Tested a full restore of our primary database and reviewed our disaster recovery plan in a tabletop exercise.
- Enforced two-step verification across Google Workspace.
Talk to our security team
Send your security questionnaire, request documents, or ask a question. We reply from security@gingercontrol.com.
Found a vulnerability?
Read our disclosure policy and report it to security@gingercontrol.com.