Enterprise-grade compliance.

SOC 2 Type II

Independently audited security controls for enterprise requirements.

HIPAA Eligible

BAA available for healthcare organizations handling PHI.

GDPR Compliant

Full compliance with EU data protection regulations.

ISO 27001

Certified information security management system.

Infrastructure Security

Data Encryption

All data is encrypted at rest using AES-256 and in transit using TLS 1.3. We use AWS KMS for key management with automatic key rotation.

Network Security

Our infrastructure runs in isolated VPCs with strict network segmentation. All traffic is monitored and logged. We employ WAF protection and DDoS mitigation at the edge.

Access Control

We implement the principle of least privilege for all access. Employee access to production systems requires MFA and is logged. All access is reviewed quarterly.


Application Security

Secure Development

All code changes undergo mandatory security review. We run automated static analysis (SAST) and dynamic testing (DAST) in our CI/CD pipeline. Dependencies are continuously scanned for vulnerabilities.

Authentication

We support SSO via SAML 2.0 and OIDC. API authentication uses scoped API keys with configurable permissions. All authentication events are logged for audit purposes.

Penetration Testing

We conduct annual third-party penetration tests and continuous bug bounty programs. Critical findings are remediated within 24 hours.


Data Privacy

Data Handling

Customer data is logically isolated at the application layer. We never access customer data without explicit permission. Data retention follows configurable policies and supports regulatory requirements.

Data Location

By default, data is processed in the US (AWS us-east-1). We offer EU data residency (eu-west-1) for customers who require it. Enterprise customers can specify additional data location requirements.

Subprocessors

We maintain a list of all subprocessors and notify customers 30 days before adding new ones. Current subprocessors include AWS (infrastructure), Stripe (billing), and Datadog (monitoring).


Incident Response

We maintain a documented incident response plan with defined escalation procedures. Security incidents are communicated to affected customers within 72 hours. Post-incident reviews are conducted and shared when appropriate.


Reporting Vulnerabilities

If you discover a security vulnerability, please report it to security@attest.ai. We operate a responsible disclosure program and will work with you to address any issues promptly.


Request Security Documentation

Enterprise customers can request our SOC 2 Type II report, penetration test summaries, and security questionnaire responses by contacting security@attest.ai.