Trust center
Controls, reports and subprocessors in one place, so your security review takes days instead of weeks.
117
Controls tested, zero exceptions
Sep 30
Last restore test passed
0
Open critical or high findings
10
Subprocessors, all reviewed
SOC 2 Type II
AICPA attestation, annual
ISO/IEC 27001:2022
Certified June 2026
GDPR
Processor terms and SCCs
CCPA/CPRA
Service provider terms
DPDP Act 2023
Grievance Officer appointed
IRS Accountable Plan
Substantiation checks aligned
Controls by domain
A live summary of the controls auditors test, with current status and the date each was last verified.
| ID | Control | Domain | Status | Last tested |
|---|---|---|---|---|
| AC-01 | SSO with enforced MFA for all staff Okta with phishing-resistant WebAuthn factors for production roles | Access | Implemented | 2026-08-14 |
| AC-04 | Quarterly access reviews Production, data warehouse and support tooling reviewed by system owners | Access | Monitored | 2026-07-02 |
| AC-07 | Just-in-time production access Approved, ticketed sessions that expire after 4 hours | Access | Implemented | 2026-08-14 |
| DP-02 | PAN masking at ingestion Card numbers cut to last 4 before persistence, verified by canary tests | Data protection | Monitored | 2026-09-03 |
| DP-05 | Encryption at rest with AES-256 AWS KMS customer master keys, per-tenant data keys on Enterprise | Data protection | Implemented | 2026-08-14 |
| DP-06 | TLS 1.2+ in transit HSTS preload, weak ciphers disabled, quarterly scans | Data protection | Monitored | 2026-09-18 |
| DP-09 | Zero model training on customer data Contractual zero-retention terms with the drafting provider, no training pipelines on tenant data | Data protection | Implemented | 2026-06-30 |
| IN-01 | Region-pinned tenant storage US East and Mumbai stacks with no cross-region replication of customer content | Infrastructure | Implemented | 2026-08-14 |
| IN-03 | Infrastructure as code with peer review Terraform changes require two approvals and pass policy checks | Infrastructure | Monitored | 2026-09-01 |
| SD-02 | SAST, dependency and secret scanning Blocking checks on every pull request | Secure development | Monitored | 2026-09-22 |
| SD-05 | Third-party penetration testing Twice yearly, application and cloud configuration | Secure development | Implemented | 2026-07-28 |
| IR-01 | 24/7 on-call and incident runbooks Customer notification within 48 hours of a confirmed data incident | Incident response | Implemented | 2026-08-21 |
| IR-03 | Quarterly tabletop exercises Most recent scenario: compromised connector OAuth token | Incident response | Monitored | 2026-09-10 |
| BC-01 | Backups with tested restores Point-in-time recovery, RPO 1 hour, RTO 4 hours, restore tested monthly | Continuity | Monitored | 2026-09-30 |
| VM-02 | Annual subprocessor security review SOC 2 or ISO evidence collected and reviewed for every subprocessor | Vendor management | In review | 2026-09-26 |
| PR-01 | DPDP Act 2023 consent and grievance process Grievance Officer appointed, 30-day response tracking | Privacy | Implemented | 2026-08-05 |
16 of 16 controls shown. Full mapping to SOC 2 TSC and ISO 27001 Annex A in the SOC 2 report.
Documents
Public documents open directly. Reports marked NDA are shared after a mutual NDA, usually within one business day.
- NDA
SOC 2 Type II report
Security, availability and confidentiality. Period Mar 1 to Aug 31, 2026.
PDF, 84 pages
- NDA
Penetration test summary
Cobalt Ridge Security, July 2026. Application and AWS configuration.
PDF, 11 pages
- Request
ISO/IEC 27001:2022 certificate
Certificate and statement of applicability scope summary.
PDF, 3 pages
- Request
CAIQ v4.0.3
Cloud Security Alliance consensus assessment, 261 questions answered.
XLSX
- Request
Security whitepaper
Architecture, masking, encryption and residency in depth.
PDF, 22 pages
- Public
Data processing agreement
GDPR, CCPA/CPRA and DPDP Act terms with SCCs.
Web
- Public
Security policy
Program, encryption, incident response and disclosure.
Web
Request access
Tell us which documents you need. We send the NDA by email and release the reports through a secure, watermarked link.
Subprocessors
Ten vendors process customer data on our behalf. We give 30 days notice before adding one.
Amazon Web Services
Hosting and storage
US East, Mumbai
Cloudflare
CDN, WAF, DDoS protection
Global edge
Anthropic, PBC
Message drafting, zero retention
US
Datadog
Monitoring, scrubbed logs
US
Slack and Microsoft
Approved message delivery
US, customer tenant
Stop playing expense police. Put policy enforcement on autopilot.
Connect Phyto Nex AI to your expense tool in 15 minutes and see what slipped past managers this month.
14-day free production trial. Read-only connectors. No card required.