FAQ
Security questions, answered.
The questions we hear most from IT, security and procurement teams.
Does GingerControl have a SOC 2 report?
Not yet. We signed an engagement letter with a CPA firm in October 2026 for a SOC 2 examination covering Security, Availability and Confidentiality. Fieldwork has not started. Once the report is issued, customers can request it under NDA; prospects can receive it with our auditor's consent.
Is GingerControl ISO 27001 certified?
Not yet. We signed a certification contract for ISO/IEC 27001:2022 in October 2026. The Stage 1 audit is not yet scheduled. We will publish the certificate here once it is issued.
Do you use our data to train AI models?
No. We never use customer data to train AI models. See AI and data.
Where is our data hosted?
Our production application and primary database run on Amazon Web Services in the United States (us-west-2, Oregon). Files customers upload are stored in Google Cloud Storage in the European Union (EU multi-region). Our search index runs on Elastic Cloud in the United States (Google Cloud, us-central1). Other providers are listed on our subprocessor list.
Is our data encrypted?
Yes. Our primary production database and its backups are encrypted at rest. Our product APIs are served over HTTPS and accept TLS 1.2 or higher, and the primary database requires encrypted connections.
Do you run penetration tests?
We completed an internal vulnerability assessment of our web application, our two main APIs, and our AWS and Google Cloud accounts in October 2026, and track every finding to closure. An independent penetration test is planned.
Can you complete our security questionnaire?
Yes. Send it to security@gingercontrol.com.
How do we get your policies or reports?
Request them on our Documents page or by email. We share them under NDA.
Who can access our data at GingerControl?
Administrative access to production is limited to designated staff. Company accounts require two-step verification, and access to AWS, Google Cloud and GitHub is reviewed at least once a year.
How do we report a security issue?
Follow our disclosure policy and email us.