Aptean

Aptean hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Aptean is SOC 2 Type II compliant and holds SOC 2 Type II, NIST CSF, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Aptean hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@aptean.com or via a /security page.

Aptean lists 17 subprocessors on its trust center, including AWS, Microsoft Azure, Cloudflare, CrowdStrike, Wasabi. Buyers use this for fourth-party risk review.

Aptean hosts on AWS, Azure. Data residency details are on its trust center.

Aptean's trust center is at https://trust.aptean.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Cloud Service Status Page. At Aptean, we understand the importance of maintaining a reliable and transparent cloud environment for our customers. We have a continued commitment to service availability and keeping you informed about the status of our cloud services. We provide a dedicated cloud service status page located at https://status.apteancloud.com. This status page offers real-time information about the health and availability of our cloud services. Including: * Service Overview: A clear view of the overall health of our cloud platform, indicating any ongoing incidents or disruptions. * Individual Service Status: Detailed information on the status of each individual cloud service we offer. This may include current status (operational, degraded performance, etc.), incident history, and ongoing maintenance activities. * Incident Updates: Timely updates on any incidents affecting our cloud services, including the nature of the issue, troubleshooting efforts, and estimated resolution timelines. * Subscription Notification Management: For subscribed users, the ability to manage notification preferences and receive alerts about specific services or incidents that may impact their operations. If you cannot see your cloud service listed, please contact your Aptean Account Manager who may provide a dedicated link to your instance.

Instead of ISO 27001, we have chosen to pursue SOC 2 Type II compliance, a comprehensive framework that validates our adherence to industry-leading security standards. SOC 2 Type II compliance focuses on key areas such as security, availability, processing integrity and confidentiality of customer data. It involves rigorous third-party audits to ensure that our security controls meet the highest standards. We believe that SOC 2 Type II compliance aligns closely with the nature of our services and demonstrates our dedication to protecting your sensitive information.

Aptean maintains Customer Success Handbooks for each cloud product and service, each handbook details information such as Support Hours, Critical Support, Response SLA's, Severity Classifications, Support Process and more. The resource tab contains links to the Customer Success Handbooks for all Cloud Products and Services, alternatively if you are already an Aptean Customer, you can access support directly as well as the latest handbooks, training materials, and more direct through the Aptean Connect Portal.

Aptean maintains Legal Centers with contractual agreements available by locality and in local language. Agreements include items such as: * Aptean MSA * Aptean SaaS Exhibit * Software License Terms Exhibit * Professional Services Exhibit * Renewals Exhibit * Template Order Form Legal Centers can be found in the following regions: North America * Aptean Legal Center - North America (non-Canada) * Aptean Legal Center - North America EMEA * Aptean Legal Centre - Belgium * Aptean Legal Centre - France * Aptean Legal Centre - Italy * Aptean Legal Centre - Ireland * Aptean Legal Centre - The Netherlands * Aptean Legal Centre - Spain * Aptean Legal Centre - Sweden & Denmark * Aptean Legal Centre - UK DACH * Aptean Legal Centre - Austria * Aptean Legal Centre - Germany APAC * Aptean Legal Centre - Australia * Aptean Legal Centre - Singapore If you would like information about which local site contains agreements relevant to you, please contact your Aptean Account Team.

### Aptean Responsible Vulnerability Disclosure Program Aptean is dedicated to upholding the security of its products and services. We deeply appreciate the efforts of security researchers in aiding us to identify and address potential vulnerabilities. This document serves as a guide to our responsible vulnerability disclosure program, detailing the process for reporting security vulnerabilities responsibly. Bug Bounty Program: While Aptean does not currently operate a public bug bounty program, we actively encourage and welcome responsible vulnerability disclosure by security researchers. What to Report: We encourage the reporting of any previously unidentified vulnerabilities in Aptean products with a CVE (Common Vulnerabilities and Exposures) rating of 7 or higher. We are particularly interested in vulnerabilities that could: * Compromise the confidentiality, integrity, or availability of user data or systems. * Allow unauthorized access to user accounts or systems. * Lead to denial-of-service attacks. * Elevate privileges within a system. How to Report: Please submit your vulnerability report to the following email address: [security@aptean.com](mailto:security@aptean.com). Report Content: Your vulnerability report should include the following information: * A detailed description of the vulnerability, along with steps to reproduce it. * The affected product(s) and version(s). * Any relevant screenshots or proof-of-concept code (if applicable). * Your contact information (optional). What We Will Do: * We will acknowledge receipt of your report within 72 hours. * Our team will promptly investigate and address the reported vulnerability. * We will keep you updated on the progress of our investigation and remediation efforts. * Upon patching the vulnerability and providing a fix, we may publicly disclose the vulnerability. What We Request: * Please refrain from exploiting vulnerabilities in our products for testing purposes. * Do not disclose vulnerability…