Trust & Compliance
Demanding vendors is good security. Start with us.
An MSSP holds some of the most privileged access in your environment. You should scrutinize ours harder than any other vendor's. This page is the standing answer to that scrutiny — and we'll put all of it in writing during diligence.
Frameworks
Compliance frameworks our services map to
We operate services so that evidence for these frameworks is generated as a byproduct of daily operations — not reconstructed before an audit.
SOC 2
Readiness, evidence collection, and control operation for Type I and Type II audits.
ISO 27001
ISMS design and control mapping for organizations pursuing or maintaining certification.
HIPAA
Security Rule safeguards and monitoring for covered entities and business associates.
PCI DSS
Logging, monitoring, and vulnerability management aligned to cardholder data requirements.
CMMC
Practice implementation and evidence support for defense supply-chain requirements.
CIS Controls
Our default baseline for pragmatic, prioritized hardening when no framework mandates one.
Access
How we handle access to your environment
- Access is scoped per engagement to the minimum required, documented, and approved by you before onboarding completes
- Multi-factor authentication and hardware-backed credentials are enforced for every analyst, everywhere
- All access to client environments is logged and reviewable by the client at any time
- Access reviews run quarterly; departures and role changes trigger same-day revocation
- Engagement end means access end — verified removal, confirmed in writing
Data
How we handle your data
- Telemetry and detections live in tenants you control wherever the platform allows it
- We collect the minimum client data needed to operate the service — no resale, no secondary use, ever
- Client data is encrypted in transit and at rest, segregated per client
- Documentation, runbooks, and detection content we build for you are your property
- Offboarding includes complete handover and certified deletion of residual data
Our own posture
We eat our own cooking
Every control we recommend, we run internally first. If a practice is too burdensome for us to follow, we won't ask your team to follow it either.
- We run our own security program on the same operating model we sell — monitored, tested, and reviewed
- Annual third-party penetration testing of our infrastructure
- Background checks and security training for every employee
- Documented incident response plan with defined client-notification commitments
- Vendor risk reviews for every tool in our own stack
Put us through your security review
Send us your diligence questionnaire — we answer every question directly, in writing, without a sales filter.