SOC 2
Our approach, and how to ask about our status
Where we stand on SOC 2
We build with the SOC 2 Trust Service Criteria in mind. No SOC 2 report is published on this site, so please ask us about our current status before relying on one.
Overview
SOC 2 is an AICPA attestation in which an independent auditor reports on a company's controls for security, availability, processing integrity, confidentiality, and privacy. A Type I report looks at how controls are designed at one point in time. A Type II report looks at how they operated over a period.
If your vendor review requires a SOC 2 report, contact us and we'll tell you where we stand and what we can share. The controls below are in the product today.
What's included
Production-grade capabilities, ready to enable in your workspace.
Multi-factor authentication
Accounts can require a time-based one-time code at sign-in.
OAuth sign-in
Sign in with an existing identity provider account instead of another password.
Secrets in HashiCorp Vault
Credentials are kept in Vault rather than in application configuration.
Audit console
Activity is recorded so it can be reviewed later, behind an MFA check.
Encryption in transit
Public VxCloud endpoints are served over HTTPS.
Card data stays with providers
Card numbers for VxCloud billing are handled by Stripe and PayPal, not stored by us.
Frequently asked questions
Still have questions? Our enterprise team answers within one business day.
No report is published on this site. Contact us and we'll tell you our current status and what we can share for your review.
Related enterprise capabilities
Ready to move forward with SOC 2?
Talk to our enterprise team — we'll scope your requirements, map the right capabilities, and build a rollout plan tailored to your organization.