16approved controls TrustDesk drafts answers from. Freshness is computed from each control's review and expiry dates — stale evidence is surfaced first because it gates automation.
Privacy & Data Retention
A current list of subprocessors is maintained and published. Subprocessors are bound by data protection agreements, and customers are notified of material changes with the opportunity to object.
Vulnerability Management
Security patches are prioritized by severity. Critical vulnerabilities are remediated within defined SLA windows, tracked to closure, and reported to security leadership.
AI & Model Governance
AI features operate under a documented governance program covering approved use cases, data handling, human oversight, and evaluation. Customer data is not used to train shared or third-party foundation models without explicit consent.
Incident Response
Customers are notified of confirmed breaches affecting their data without undue delay and within the timelines defined in the applicable agreement and regulation. Regulatory notifications follow documented runbooks.
Encryption & Data Protection
Encryption keys are managed in a dedicated KMS with hardware-backed protection. Keys are rotated at least annually and on personnel change, with access restricted by least privilege.
Business Continuity & Resilience
Business continuity and disaster recovery plans define RTO and RPO targets, are tested at least annually, and rely on geographically redundant infrastructure with automated, regularly validated backups.
Cloud & Infrastructure Security
The platform is hosted on a major cloud provider in a logically segregated, multi-tenant architecture. Network controls, security groups, and private subnets isolate production workloads from other environments.
Compliance & Certifications
The company maintains a SOC 2 Type II report and ISO/IEC 27001 certification. Reports and certificates are available to customers and prospects under NDA through the trust portal.
Privacy & Data Retention
Customer data is retained only as long as necessary to provide the service or meet legal obligations. On contract termination, customer data is deleted or returned within the period defined in the data processing agreement.
Encryption & Data Protection
All customer data is encrypted at rest using AES-256. Encryption is enabled at the storage layer across all production data stores, including backups and snapshots.
Encryption & Data Protection
All data in transit is protected using TLS 1.2 or higher. Legacy protocols (SSL, TLS 1.0/1.1) are disabled, and HSTS is enforced on all public endpoints.
Access Control & Identity
Access to production systems follows role-based access control and least privilege. Access is provisioned through approved requests, reviewed quarterly, and revoked promptly on role change or offboarding.
Access Control & Identity
Multi-factor authentication is enforced for all employee and administrative access. Workforce access is federated through SSO with phishing-resistant factors required for privileged roles.
Incident Response
A documented incident response plan defines roles, severity tiers, and escalation paths. The plan is tested at least annually through tabletop exercises, and post-incident reviews are conducted for all major incidents.
Vulnerability Management
Continuous vulnerability scanning runs across production and build pipelines. Independent third-party penetration tests are performed at least annually, and an executive summary is available under NDA.
Vendor & Third-Party Risk
Vendors are risk-assessed before onboarding and reassessed periodically based on data sensitivity and criticality. Security and privacy requirements are flowed down through contractual terms.