Is this your company? Buyers are checking Armsrm here. Claim armsrm.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Armsrm
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Armsrm is SOC 2 Type II compliant. Armsrm also holds NIST CSF, HIPAA, PCI DSS, and GDPR.
About
ARMStrong RM is the Largest Receivable Management Firm in North America ====================================================================================== ARMStrong Information Security, Privacy, and Compliance teams work together to build and maintain the trust of our members through visibility into our security posture and compliance readiness. Through our Trust Center we aim to demonstrate to both our members and prospective members that we have the processes and protocols in place to safeguard your data.
Compliance & infrastructure
Hosting
AWSAzure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
29Documents
- Access Management PolicyRequest
- Asset Management PolicyRequest
- Business Continuity and Disaster Recovery PlanRequest
- Code Of Conduct And Corporate StandardsRequest
- Encryption And Cryptography PolicyRequest
- Data Management PolicyRequest
- Incident Response Policies and Procedures (including GDPR)Request
- Information Security Roles and ResponsibilitiesRequest
- Operations Security PolicyRequest
- Physical Security PolicyRequest
- Risk Management Policy and ProceduresRequest
- Secure Development PolicyRequest
- Third-Party Management PolicyRequest
- Backup & Recovery PolicyRequest
- Clear Screen and Desk PolicyRequest
- Data center And Server Rooms PolicyRequest
- Employee Identification PolicyRequest
- Firewall & Routers Security Administration PolicyRequest
- Information Security Exception Request ProcessRequest
- Internet Usage PolicyRequest
- IT Change Control PolicyRequest
- Mobile Device Security PolicyRequest
- Monitoring & Logging PolicyRequest
- Patch Management PolicyRequest
- Remote Working And Access PolicyRequest
- Privileged Account Management PolicyRequest
- AI Usage PolicyRequest
- Security Awareness Training and AcceptableRequest
- Information Security PolicyPublic
Subprocessors
24- SSalesforce · CRM platform and client relationship managementCloud, United States
- BBitDefender · Advanced endpoint threat protectionCloud, United States
- AAlienvault · Security Information and Event Management (SIEM)Cloud, United States
- CCodeTwo · Centralized email signature managementCloud, United States
- CCrimson Security · Security3rd Party Vendor
- MMicrosoft (Azure & 365) · Cloud hosting, productivity, identity managementCloud, United States
- OOffice 365 · Cloud hosting, productivity, identity managementCloud, United States
- KKnowBe4 · Security awareness & phishing simulationCloud, United States
- ZZoom · Communication platformCloud, United States
- CCisco Umbrella · DNS filtering, cloud-delivered threat protectionCloud, United States
- PPulseway · Remote monitoring and management (RMM)Cloud, United States
- IIT-Glue · IT documentation managementCloud, United States
Show all 24 subprocessorsShow fewer
- AAdminDroid Office 365 Reporter - Sign In · Microsoft 365 reporting and auditingARMStrong Data Center, United States
- AAmazon Web Services · Cloud hosting and data storage for certain applicationsCloud, United States
- FFreshservice · IT service management (ITSM) and ticketingCloud, United States
- SSpanning Backup · Backup and recovery for Microsoft 365 and SalesforceCloud, United States
- TTCN · Cloud-based contact center and outbound dialing platformCloud, United States
- TTransUnion · Phone number validation and DID verificationCloud, United State
- TTRX Services, LLC · Credit card payment processingCloud, United States
- UUS Signal · Data center and colocation servicesIllinois, United States
- VVanta · Continuous security monitoring and compliance automationCloud, United States
- VVeeam · Backup, disaster recovery, and replicationARMStrong Data Centers, United States
- VVMWare · Virtualization and infrastructure managementARMStrong Data Centers, United States
- ZZoomInfo · Business contact enrichment and prospect data intelligenceCloud, United States
Compliance leadership
The person who leads Armsrm's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Armsrm's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Armsrm SOC 2 compliant?
Armsrm is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Armsrm NIST CSF compliant?
According to Armsrm's public trust center, Armsrm is NIST CSF compliant. On SOC2C this listing is Listed.
Is Armsrm HIPAA compliant?
According to Armsrm's public trust center, Armsrm is HIPAA compliant. On SOC2C this listing is Listed.
Is Armsrm PCI DSS compliant?
According to Armsrm's public trust center, Armsrm is PCI DSS compliant. On SOC2C this listing is Listed.
Is Armsrm GDPR compliant?
According to Armsrm's public trust center, Armsrm is GDPR compliant. On SOC2C this listing is Listed.
Is Armsrm SOC 2 Type I or Type II?
Armsrm is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Armsrm's SOC 2 for a vendor risk assessment?
Yes. Armsrm's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Armsrm penetration tested?
Armsrm hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Armsrm secure?
Security isn't a single yes/no, but Armsrm is SOC 2 Type II compliant and holds SOC 2 Type II, NIST CSF, HIPAA, PCI DSS, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Armsrm have a bug bounty or vulnerability disclosure program?
Armsrm hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@armsrm.com or via a /security page (Armsrm lists a security contact).
Who are Armsrm's subprocessors?
Armsrm lists 24 subprocessors on its trust center, including Salesforce, BitDefender, Alienvault, CodeTwo, Crimson Security. Buyers use this for fourth-party risk review.
Where does Armsrm host or store data?
Armsrm hosts on AWS, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is Armsrm's trust center or security page?
Armsrm's trust center is at https://trust.armsrm.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Armsrm
Reproduced from Armsrm's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
How is client data protected at ARMStrong?
Client data is protected through enterprise-grade encryption both in transit and at rest. We utilize Microsoft Entra and Intune for identity and device access management, and our environments are regularly audited under SOC 2 Type II and PCI-DSS 4.0 frameworks.
Do you encrypt data at rest?
Yes. All sensitive data is encrypted at rest using AES-256 encryption, and in transit using TLS 1.2+ protocols across all environments.
What endpoint security solutions do you use?
We use a multi-layered approach to endpoint protection that includes Microsoft Defender for Endpoint, Bitdefender Enterprise for advanced threat prevention, and Cisco Umbrella for DNS-layer protection. In addition, we leverage AT&T Cybersecurity (AlienVault) SIEM for real-time threat detection and centralized log analysis. All endpoints are managed and monitored through Microsoft Intune, ensuring compliance and rapid response to any anomalies.
How is physical security handled for your infrastructure?
Our data is hosted in Tier IV data centers with multi-layered physical security, including biometric access controls, video surveillance, and 24/7 monitoring.
Are you SOC 1/2 or PCI compliant?
Yes. ARMStrong maintains SOC 1 Type II and SOC 2 Type II certification and adheres to PCI-DSS 4.0 standards for handling sensitive financial data.
Do you support HIPAA compliance?
Yes. While we are not a covered entity, our security practices align with HIPAA data protection requirements, and we offer Business Associate Agreements (BAAs) as needed.
How do you ensure regulatory compliance for data processing?
Our systems are audited annually by third-party assessors. We follow least-privilege access models, enforce MFA, and maintain a seven-year data retention policy to align with industry and legal requirements.
Where is client data stored?
All data is stored in U.S.-based data centers. We do not use offshore storage or processing for client data unless explicitly approved in writing.
Do you allow international access to your systems?
Access is strictly geo-controlled using Microsoft Entra Conditional Access. International access is only allowed if pre-approved and tied to official business operations, with a dedicated IP address.
Who has access to my data?
Only authorized personnel with a legitimate business need have access. All access is logged and regularly reviewed.
What systems and platforms does ARMStrong use?
We use Microsoft 365 (including Entra, Defender, Intune), Salesforce (U.S. data centers only), Pulseway for RMM, and Zoom for communication. We also utilize Cisco Umbrella, AlienVault, and KnowBe4 for endpoint and training security.
Do you use AI or machine learning on client data?
AI solutions are restricted to Microsoft Copilot. No third-party AI tools (e.g., ChatGPT, Bard) have access to client data. All AI usage is monitored and controlled via Valum.ai.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public