Is this your company? Buyers are checking Donut here. Claim donut.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Donut
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Donut is SOC 2 Type II compliant.
About
Donut is an employee experience platform that scales key people programs. Donut integrates with tools that you and your employees use every day to seamlessly automate workflows, build networks, and more.
Compliance & infrastructure
Hosting
AWS
Subprocessors
37- AAmazon Web Services · Cloud hosting, servers, and databasesUnited States
- GGoogle Workspace · Email, docs, and analyticsUnited States
- HHeroku · App hosting and databaseUnited States
- SSlack · Internal messagingUnited States
- CCloudflare · DNS managementUnited States
- CCircleCI · Code delivery/deployment pipelineUnited States
- DDatadog · Metrics gathering and monitoringUnited States
- GGitHub · Code management and version controlUnited States
- FFullstory · Web app usage and supportUnited States
- HHevo Data Inc. · Syncing data from production data stores to data warehouseUnited States
- HHubspot · Customer relationship management and marketingUnited States
- IIntercom · Support via live chat and email, key customer updatesUnited States
Show all 37 subprocessorsShow fewer
- MMailChimp · Newsletter for users who opt inUnited States
- MMailgun · Service emailsUnited States
- MMerge · *Optional* subprocessor for customers that choose to integrate their Human ResouUnited States
- MMixpanel · Aggregate usage trackingUnited States
- OOpenAI · Generate content to be used in Donut productsUnited States
- PPapertrail · Log aggregationUnited States
- PProfitwell · Financial analysisUnited States
- SSentry · Application MonitoringUnited States
- RRillet · AccountingUnited States
- SSisense (formerly Periscope Data) · Aggregate usage analysisUnited States
- SStripe · Payment collection and handlingUnited States
- ZZoom · User research, customer support, salesUnited States
- LLinear · Tracking customer feedback and roadmap planningUS
- AAnthropic · Content generationUnited States
- CCanva · Content design and creationUnited States
- LLangfuse · Monitoring LLM performanceUnited States
- NNotion · Documentation and note-takingUnited States
- TTremendous · Gift card fulfillmentUnited States
- VVercel · Hosting and delivering front-end applications.United States
- CConvex · Handles our back-end data operations and ensuring secure data processing and stoUnited States
- RResend · Sends transactional emails and monitoring email performance for some Donut appliUnited States
- RRailway · Used for hosting front end and backend web application and their related assets.United States
- RRecall.ai · *Optional* Meeting recording and transcript generation for Indigo customers.
- SStorylane · Sales and marketing demosUS
- VViktor · Internal productivityUS
Compliance leadership
The person who leads Donut's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Donut's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Donut SOC 2 compliant?
Donut is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Donut SOC 2 Type I or Type II?
Donut is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Donut's SOC 2 for a vendor risk assessment?
Yes. Donut's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Donut penetration tested?
Donut hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Donut secure?
Security isn't a single yes/no, but Donut is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Donut have a bug bounty or vulnerability disclosure program?
Donut hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@donut.com or via a /security page (Donut lists a security contact).
Who are Donut's subprocessors?
Donut lists 37 subprocessors on its trust center, including Amazon Web Services, Google Workspace, Heroku, Slack, Cloudflare. Buyers use this for fourth-party risk review.
Where does Donut host or store data?
Donut hosts on AWS. Data residency details are on its trust center.
Where is Donut's trust center or security page?
Donut's trust center is at https://trust.donut.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Donut
Reproduced from Donut's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Do you have a Data Protection Addendum?
We do! You can view Donut's DPA here.
What Slack data does Donut access?
*Slack Permissions* Donut uses Slack's Granular Permissions in order to request only the permissions we need to make the app function. When you install Donut on your Slack workspace Slack will present you with a list of the specific permissions that Donut requests, and you will have an opportunity to approve or reject those permissions. *Channel and Message Access* Donut's access to messages in Slack is quite limited, for two main reasons: 1. Donut only can read messages in channels or DMs where Donut is a member. 2. Donut only needs to be in the channel(s) where you want to use Donut. Consequently Donut will only be a member of channels that a user invites it to or where a user explicitly sets up Donut features. This means that Donut does not have access to anyone's private DMs (unless it's a DM with Donut), nor does Donut have access to any public or private channel content unless someone from your team has explicitly added Donut to the channel.
What are your security best practices?
Donut is hosted on Heroku and AWS and benefit from their world-class security. We leverage Slack’s OAuth for signing into our website, making Donut as secure as Slack. Our website and servers use HTTPS over SSL (TLS 1.3) to protect user data. Donut is built on Ruby on Rails and benefits from the same Rails security that is trusted by industry. Donut is used by Fortune 500, FinTech, and cloud-security companies, among others.
Do you support Single Sign-On (SSO)?
We use Slack's OAuth authentication for signing into Donut — this is the only way to sign into our site. Therefore we indirectly support any SSO that Slack supports.
How is data stored? Do you encrypt data at rest?
We store our application data in Heroku Postgres and benefit from their world-class safety and security, which includes encryption at rest. We use Heroku PGBackups for backing up our Postgres database.
What is your data retention policy?
Our bot receives messages that are sent in channels, DMs, and groups where it is a member. However the only messages that we store in our database are those that are sent in the multiparty DMs that the Donut bot creates when it pairs people up, those sent in DM with the Donut bot, and those sent in channels where Donut is explicitly set up. We store the messages from these DMs in order to collect feedback and improve the product.
What data do you use?
For our pairing algorithm, we look at who is in which channels — we do not look at or analyze any messages (and we cannot see any messages from channels we are not in). For analytics, the only other relevant data we pay attention to is how many people are in each Slack team.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public