Controls
Security controls, in place today.
Each control below is tracked in Sprinto against SOC 2 and ISO 27001. Evidence for any control is available to customers under NDA.
71 controls in place1 planned2 audits engaged
Infrastructure security
15 controls
Production hosted on AWS in the United States
Our application and primary database run in AWS us-west-2 (Oregon).
Database network access restricted
The production database accepts connections only from an allowlist of approved sources. All other internet traffic to it is blocked.
Firewall rules reviewed
Cloud firewall and security group rules are reviewed against a deny-by-default standard.
Audit logging in every AWS region
AWS CloudTrail records account activity across all regions, with log file validation.
Network traffic logged
VPC flow logs record network traffic in our AWS environment.
Log storage access logged
Access to our audit and flow log buckets is itself logged.
Threat detection enabled
Amazon GuardDuty in our production region and Google Cloud Security Command Center watch for suspicious activity.
Threat findings triaged
GuardDuty findings are reviewed, triaged and recorded.
Cloud resources inventoried and classified
Every production cloud resource is recorded and classified in our compliance platform.
Root account protected
The AWS root account is protected with multi-factor authentication.
Websites served over HTTPS
Our websites and web app redirect HTTP to HTTPS.
Administrative access encrypted
Cloud consoles and command-line tools connect over TLS.
Network security standards documented
A Communications & Network Security Policy and a Network Security Procedure set our network standards.
Operations security
An Operation Security Policy and an Operations Security Procedure govern how production systems are run.
Data center physical security
Production runs in AWS and Google Cloud data centers, and we review AWS's independent SOC 2 report.
Data protection
15 controls
Encryption at rest
Our primary production database and its backups are encrypted at rest.
Encryption in transit
Our product APIs are served over HTTPS and accept TLS 1.2 or higher, and the primary database requires encrypted connections.
Encryption standard documented
An Encryption Policy sets our standards for protecting data at rest and in transit.
No training on customer data
Customer data is never used to train AI models.
AI model providers assessed
OpenAI, Anthropic and Google are recorded and risk-assessed in our vendor register.
Reviewable AI output
Every classification carries its GRI reasoning and the CROSS rulings it cites, so your team can check it.
Automated backups
Primary database backups run automatically, with point-in-time recovery.
Backup restore tested
A full restore of our primary database was tested in October 2026.
Log storage protected
Audit logs are kept in a private, versioned bucket with public access blocked.
Subprocessors disclosed
Every third party that processes customer data is listed on this site.
Data classification policy
A Data Classification Policy defines how information is classified and handled.
Data retention policy
A Data Retention Policy governs how long data is kept.
Secure media disposal
A Media Disposal Policy governs how storage media are wiped or destroyed.
Data protection and privacy by design
A Data Protection Policy and a Privacy By Design Policy apply privacy requirements to how we handle data and build features.
Breach notification procedure
A Data Breach Notification Policy and a Personal Data Breach Notification Procedure define how we inform affected parties.
Access control
7 controls
Two-step verification on company accounts
Enforced for every Google Workspace account.
Two-factor authentication for source code
Required for every member of our GitHub organization.
Access reviews
Access to AWS, Google Cloud and GitHub is reviewed at least once a year. The first review of all three was completed in October 2026.
Administrative access limited
Administrative access to production is limited to designated staff.
Access control policy and procedure
A documented Access Control Policy and Access Control Procedure govern how access is granted and removed.
Password standard enforced
Google Workspace enforces our documented password standard.
Inactive cloud credentials monitored
Unused AWS credentials are flagged by continuous monitoring.
Application security
8 controls
Peer-reviewed code changes
Code changes to our main application repositories merge through a pull request approved by a reviewer.
Secure development lifecycle
A System Acquisition and Development Lifecycle Policy and an SDLC Procedure govern how code is built, reviewed and released.
Private source code
Every repository in our GitHub organization is private.
Dependency scanning
Dependency vulnerability alerts run on all production code repositories.
Container image scanning
Container images are scanned for known vulnerabilities when pushed to our registry.
Vulnerability assessment
An internal assessment of our web application, our two main APIs, and our AWS and Google Cloud accounts was completed in October 2026.
Findings tracked to closure
Each finding has an owner and a target date, and is tracked until it is fixed.
Independent penetration test
A third-party penetration test is planned.
People security
11 controls
Policies acknowledged
Every staff member has acknowledged our information security policies.
Security awareness training
Completed by every staff member.
Code of conduct
A Code of Business Conduct Policy is in place and acknowledged by staff.
Acceptable use acknowledged
Staff acknowledge our Acceptable Usage Policy.
Security roles assigned
Named owners for information security, compliance, infrastructure and people operations.
Organization structure documented
An organization chart is maintained and reviewed.
Hiring evaluations and background checks
Recorded for new hires.
HR security
An HR Security Policy and HR Security Procedure govern security across hiring, employment and departure.
Performance evaluations
Conducted for every staff member.
Endpoint security checks
Staff laptops are checked for disk encryption, screen lock and anti-malware protection.
Endpoint security policy
An Endpoint Security Policy sets the security requirements for staff devices.
Governance and continuity
16 controls
Information security policy set
41 policies, procedures and ISMS documents, approved in October 2026 and reviewed at least once a year.
System description maintained
A current description of our system, its boundaries and its controls.
Information security management system
An ISMS Manual, ISMS Scope Document and defined information security roles and responsibilities set out how we run security.
Risk management program
A Risk Assessment & Management Policy, a named risk owner and a maintained risk register.
Risk assessment
Risks are assessed, scored and given a treatment.
Business impact analysis
Completed for our critical systems.
Business continuity and disaster recovery plans
Documented, with defined recovery time and recovery point targets.
Disaster recovery tabletop exercise
Our disaster recovery plan was reviewed in a tabletop exercise in October 2026.
Incident response
An Incident Management Policy and Incident Management Procedure. Security incidents are logged and tracked to closure.
Change management
Changes to production follow a documented change management process.
Vendor risk management
A Vendor Management Policy and Procedure. Vendors are risk-assessed, and we reviewed the SOC 2 reports of Amazon Web Services and Elastic in October 2026.
Internal audit and management review
Conducted, with findings tracked.
Legal and regulatory register
Legal, regulatory and contractual requirements are recorded and reviewed.
Asset management
An asset management policy and procedure are in place.
Automated control checks
Our controls are tracked in Sprinto, which runs automated checks against SOC 2 and ISO 27001.
Security commitments published
Our privacy policy and this Trust Center state our commitments, and changes are posted to the updates log.