Is this your company? Buyers are checking ActivTrak here. Claim activtrak.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
ActivTrak
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
ActivTrak is SOC 2 Type II compliant. ActivTrak also holds GDPR, CCPA, and HIPAA.
About
ActivTrak provides privacy-first, data-driven insights with uncompromising security to measure and assess productivity and wellness with the employee in mind. Designed to focus on the collection of contextual data and avoid intrusive employee monitoring techniques, ActivTrak helps organizations better understand how to improve overall productivity and business outcomes and meet compliance requirements through the secure and ethical use of data intelligence built for a modern workplace.
Compliance & infrastructure
Hosting
AWSGCP
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
5Subprocessors
2- GGoogle Cloud Platform · gcpUS, EU, UK, AU, CA
- AAmazon Web Services · awsUS
Compliance leadership
The person who leads ActivTrak's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. ActivTrak's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is ActivTrak SOC 2 compliant?
ActivTrak is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is ActivTrak GDPR compliant?
According to ActivTrak's public trust center, ActivTrak is GDPR compliant. On SOC2C this listing is Listed.
Is ActivTrak CCPA compliant?
According to ActivTrak's public trust center, ActivTrak is CCPA compliant. On SOC2C this listing is Listed.
Is ActivTrak HIPAA compliant?
According to ActivTrak's public trust center, ActivTrak is HIPAA compliant. On SOC2C this listing is Listed.
Is ActivTrak SOC 2 Type I or Type II?
ActivTrak is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use ActivTrak's SOC 2 for a vendor risk assessment?
Yes. ActivTrak's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is ActivTrak penetration tested?
ActivTrak hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get ActivTrak's SOC 2 report?
ActivTrak's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is ActivTrak secure?
Security isn't a single yes/no, but ActivTrak is SOC 2 Type II compliant and holds SOC 2 Type I, SOC 2 Type II, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does ActivTrak have a bug bounty or vulnerability disclosure program?
ActivTrak hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@activtrak.com or via a /security page.
Who are ActivTrak's subprocessors?
ActivTrak lists 2 subprocessors on its trust center, including Google Cloud Platform, Amazon Web Services. Buyers use this for fourth-party risk review.
Where does ActivTrak host or store data?
ActivTrak hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is ActivTrak's trust center or security page?
ActivTrak's trust center is at https://trust.activtrak.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by ActivTrak
Reproduced from ActivTrak's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Where is data hosted?
Data is hosted in the Google Cloud Platform. Currently, data is stored in the US by default. Upon request, data for Advanced and Premium customers can be stored in one of our other locations. See ActivTrak Cloud Data Center Locations for more details.
How is data encrypted?
Data is encrypted via TLS 1.2 with AES-128 bit while in transit from the client-side agent to the ActivTrak cloud. Once at rest in the cloud, the data is encrypted using AES-256 bit.
Is the data backed up?
ActivTrak customer data is backed up within Google Cloud using Google Cloud best practices.
Does the solution log keystrokes, or scrape screens?
No, ActivTrak does not keystroke log or screen scrape, and has no intention of ever doing so. We believe in insights, not oversights.
Do you scan for malware, vulnerabilities, and SQL injections?
Yes. Supporting information can be found in the ActivTrak Policy Packet under Operations Security Policy.
In the past 3 years, has Vendor experienced any security incidents involving unauthorized access to, acquisition of, or loss of data maintained by Vendor?
No
Is audit logging enabled on the solution?
Yes, the Security Audit Log provides account administrators a way to monitor any changes or logins made to the account.
Does ActivTrak staff have access to client data within the client’s instance?
ActivTrak staff is able to access client instances, and the data therein, only for support purposes. This access is granted only after receiving explicit permission from the client. Access is controlled through RBAC, with dedicated support logins for the staff. All support access is logged for audit purposes.
Does the solution support Multi-factor Authentication (MFA) and/or Single Sign-On (SSO)?
Yes. ActivTrak recommends using Single Sign On to enforce password requirements as well as MFA. See Connect Your SSO Account with ActivTrak for more details.
Does ActivTrak perform background checks on employees and subcontractors?
Yes. More information can be found in the ActivTrak Policy Packet Human Resources Security Policy.
Does ActivTrak conduct security assessments? If so, please describe, including if it was a self-assessment or performed by a third party.
ActivTrak engages with specialized third parties to perform security assessments of its systems. Security assessments include penetration testing of both APIs and web applications.
Can end users disable or tamper with the ActivTrak agent?
Disabling or uninstalling the ActivTrak agent requires local admin access. Additionally, the ActivTrak agent runs as a background service, and is named in a way that is not easily identifiable.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public