Is this your company? Buyers are checking Conversica here. Claim conversica.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Conversica
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Conversica is SOC 2 Type II compliant. Conversica also holds ISO 27001, GDPR, CCPA, and PCI DSS.
About
Welcome to the Conversica Trust Center. We recognize that trust is built on transparency and earned with experience. For more than a decade we have been providing AI-powered digital assistant solutions from a SaaS platform, and we have implemented numerous safeguards to protect the data which our customers entrust to us.
Compliance & infrastructure
Hosting
AWSGCP
Documents
9Documents
- Conversica Security and Compliance Highlights.pdfPublic
- Conversica Business Continuity and Disaster Recovery PolicyRequest
- Conversica Acceptable Use PolicyPublic
- Conversica Notice at Collection of Personal Information and Privacy Policy for California Personnel.pdfPublic
- Conversica SIGLite.pdfPublic
- Conversica's Responsible Use of AIRequest
- Conversica, Inc.-2025-ISO 27001.2022 First Surveillance Audit-Final Report.pdfRequest
- Conversica-2025-Type 2 SOC 2-Final Report.pdfRequest
- TCPA Law Rules and Guidelines within Conversica.pdfPublic
Subprocessors
10- Amazon Web Services · Data hosting and related processing and security services.USA
- GGoogle Cloud · Data translation, DLP filtering, Vertex for vector embeddings for RAG (chat andUSA
- OOpenAI · Natural language generation for Chat, generative AI service features, NLP tasksUSA
- DDatadog · Converisca Primary Observability PlatformUSA
- TTwilio · SMS (Text Message) services.USA
- SScanii · Security Software that processes and contains files for malware, phishing, spamUSA
- WWorkato · Facilitates personal data transfer via API integration with our customers’ respeUSA
- ZZendesk · Facilitates technical support plus chat integration and related data transmissioUSA
- VVellum · Orchestration, configuration, testing, and monitoring layer for use of third parUSA
- AAtData (fka Fresh Address) · E-mail validation and analytics integrationUSA
Compliance leadership
The person who leads Conversica's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Conversica's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Conversica 2025 ISO-27001:2022 CertificateSep 2025
The latest ISO-27001:2022 certificate has been uploaded to the Conversica Trust website.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Conversica SOC 2 compliant?
Conversica is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Conversica ISO 27001 certified?
According to Conversica's public trust center, Conversica is ISO 27001 certified. On SOC2C this listing is Listed.
Is Conversica GDPR compliant?
According to Conversica's public trust center, Conversica is GDPR compliant. On SOC2C this listing is Listed.
Is Conversica CCPA compliant?
According to Conversica's public trust center, Conversica is CCPA compliant. On SOC2C this listing is Listed.
Is Conversica PCI DSS compliant?
According to Conversica's public trust center, Conversica is PCI DSS compliant. On SOC2C this listing is Listed.
Is Conversica SOC 2 Type I or Type II?
Conversica is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Conversica's SOC 2 for a vendor risk assessment?
Yes. Conversica's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Conversica penetration tested?
Conversica hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Does Conversica have an ISO 27001 certificate?
Conversica publishes an ISO certificate on its trust center; you can request access through SOC2C.
Can I get Conversica's SOC 2 report?
Conversica's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Conversica secure?
Security isn't a single yes/no, but Conversica is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA, PCI DSS. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Conversica have a bug bounty or vulnerability disclosure program?
Conversica hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@conversica.com or via a /security page.
Who are Conversica's subprocessors?
Conversica lists 10 subprocessors on its trust center, including Amazon Web Services, Google Cloud, OpenAI, Datadog, Twilio. Buyers use this for fourth-party risk review.
Where does Conversica host or store data?
Conversica hosts on AWS, GCP. Data residency details are on its trust center.
Where is Conversica's trust center or security page?
Conversica's trust center is at https://trust.conversica.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Conversica
Reproduced from Conversica's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Is Conversica a Data Controller or Data Processor?
With respect to the personal data which Conversica receives from its Customers and processes to initiate conversations with their prospects or customers, Conversica is a data processor. With respect to the data Conversica receives in connection with its own marketing efforts, Conversica is a data controller.
What transfer mechanism does Conversica use for cross-border transfers of data?
We certify to and rely on the EU-U.S. Data Privacy Framework, the United Kingdom (“UK”) extension thereto, and the Swiss-U.S. Data Privacy Framework as the primary transfer mechanisms. In addition, as a secondary mechanism we enter into the EU-approved Standard Contractual Clauses for cross-border transfers originating in the EU and similar contractual clauses for cross-border transfers originating in the UK.
Do I have to download code from Conversica to use the service?
No. But if you choose to use our website chat feature you would need to download an small amount of open-source Javascript code to deploy the chat feature. Also, if your company used salesforce as its CRM system and you wanted to transfer data from it to Conversica via the Conversica API, you could download the Conversica app from the salesforce appexchange to faciliate this transfer.
Does Conversica use any third parties in the process of providing services to customers?
Conversica does utilize sub-processors who are listed at https://trust.conversica.com/subprocessors/ All Customer Data is stored in Amazon Web Services data centers. The other sub-processors may or may not see a particular Customer’s data depending on which Conversica products and services that Customer is using.
How can I report a security issue?
You can contact us via email us at security@Conversica.com.
Do you honor data subject rights?
Yes. We have processes in place to honor data subject requests. If we receive a request directly from a data subject for whom a Customer is the data controller, we will relay the request to the Customer for their response.
Does Conversica sell data collected or stored on behalf of its customers?
No.
Is Customer Data encrypted and how?
Yes. Customer data is encrypted at rest using AES 256 and in transit using TLS 1.2.
Does Conversica have a bug bounty program?
Conversica has a responsible disclosure program which is similar to a bug bounty program. Please see the applicable policy at https://www.conversica.com/responsible-disclosure-policy/.
Where is customer data hosted?
All customer data is hosted in the cloud in the United States on Amazon Web Services facilities.
Who at Conversica will have access to customer data?
Only Conversica personnel, such as customer support technicians, who need to access customer data in order to perform the ordered services will have access to customer data.
Do Conversica systems undergo regular penetration testing?
Yes. Conversica undergoes annual external penetration testing and semi-annual application penetration testing conducted by nationally recognized firms.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public