Compliance & Certifications

SOC 2 Type II (Pending)

We are pursuing SOC 2 Type II certification, which will demonstrate our commitment to:

• Security: Protection against unauthorized access
• Availability: System uptime and performance
• Processing Integrity: Accurate and timely data processing
• Confidentiality: Protection of confidential information
• Privacy: Personal information handling practices

Status: In Progress
Expected Completion: Q2 2025

ISO 27001:2022 (Pending)

We are working towards ISO 27001:2022 certification for our Information Security Management System (ISMS), which will cover:

• Risk assessment and treatment
• Security policy and procedures
• Asset management
• Human resource security
• Physical and environmental security
• Incident management

Status: In Progress
Expected Certification: Q3 2025

ISO 27701:2019 (Pending)

We are pursuing Privacy Information Management System certification to ensure:

• Privacy risk management
• Data protection by design
• Privacy impact assessments
• Data subject rights management

Status: Planned
Expected Certification: Q4 2025

HIPAA Ready

Our platform supports HIPAA compliance for healthcare organizations:

• Administrative safeguards implementation
• Physical safeguards for on-premise deployment
• Technical safeguards including encryption and access controls
• Audit logging and monitoring capabilities
• Business Associate Agreement (BAA) available
• PHI never leaves your infrastructure

HITRUST CSF

Aligned with HITRUST Common Security Framework for comprehensive healthcare security.

PCI DSS Level 1

For organizations handling payment card data:

• Network segmentation capabilities
• Encryption of cardholder data
• Access control measures
• Regular security testing features
• Vulnerability management tools

SOX Compliance Support

Features supporting Sarbanes-Oxley compliance:

• Comprehensive audit trails
• Change management controls
• Access governance
• Data integrity controls

GDPR (European Union)

Full support for General Data Protection Regulation requirements:

• Data stays within EU jurisdiction
• Right to erasure (right to be forgotten)
• Data portability features
• Privacy by design architecture
• Consent management capabilities
• Data Processing Agreement (DPA) available

CCPA (California)

California Consumer Privacy Act compliance features:

• Consumer rights management
• Data deletion capabilities
• Opt-out mechanisms
• Data sale prevention (we never sell data)

Other Privacy Laws

Support for global privacy regulations:

• LGPD (Brazil)
• PIPEDA (Canada)
• POPIA (South Africa)
• APPI (Japan)
• Privacy Act (Australia)

FedRAMP Ready

Prepared for Federal Risk and Authorization Management Program:

• NIST 800-53 controls implementation
• Continuous monitoring capabilities
• Security assessment readiness
• Air-gap deployment option

ITAR Compliant

International Traffic in Arms Regulations compliance for defense contractors:

• Data remains on U.S. soil
• Access restricted to U.S. persons
• Export control features

NIST Cybersecurity Framework

Aligned with all five framework functions:

• Identify: Asset management and risk assessment
• Protect: Access control and data security
• Detect: Continuous monitoring and anomaly detection
• Respond: Incident response and mitigation
• Recover: Recovery planning and improvements

CIS Controls

Implementation of Center for Internet Security controls including:

• Inventory and control of assets
• Data protection
• Secure configuration
• Account management
• Malware defenses