DraftWise Inc

Yes — DraftWise Inc undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

DraftWise Inc publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Security isn't a single yes/no, but DraftWise Inc is SOC 2 Type II compliant and holds SOC 2 Type I, SOC 2 Type II, ISO 27001, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

DraftWise Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@draftwise.com or via a /security page (DraftWise Inc lists a security contact).

DraftWise Inc's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

DraftWise Inc's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

DraftWise Inc's trust center is at https://security.draftwise.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Draftwise strictly adheres to industry standards for highly sensitive data. Our engineering and security teams have deep experience building secure deployments for global companies and government agencies and hold multiple patents in data, AI, and application security. Draftwise has been certified for Cyber Security Essentials Plus and is SOC2 Type II compliant.

Draftwise has been certified for Cyber Security Essentials Plus (UK Cybersecurity standard) and is SOC2 compliant. We strictly adhere to industry standards for highly sensitive data and can further configure the security architecture to your specific requirements. Our engineering and security teams have deep experience building secure deployments for global companies and government agencies and hold multiple patents in data and application security.

Firm data is encrypted at rest & in transit. We use the following protocols: At Rest: AES-256 encryption algorithm. In Transit: Data transmission via HTTPS using TLSv1.2 or TLSv1.3. We use AWS CloudWatch for audit logs and monitoring services. Logs are collected and stored from resources, applications, and services we deploy in near-real-time. We have rules-based and composite high-resolution alerting in place. We apply anomaly detection to our container/applications. Logs are retained for up to two years. Any additional questions about encryption or audit trails/logs can be directed to sales@draftwise.com.

Draftwise is designed with technologies trusted by S&P 500 companies and intelligence agencies. We provide a variety of deployment configurations to support your firm’s technology and compliance requirements, including both cloud and on-premise deployment options. We offer containerized, access-controlled, auto-scaling SaaS offering, implemented with state-of-the-art security practices adopted by most secure S&P 500 companies and world governments. We have a control framework, audit alerting, and routine security evaluation.

Firms have two options when deploying on the cloud with Draftwise. We can deploy a private tenant or private cloud specific to your firm in a region of your choosing. By default, no data leaves the VPC or is visible to any other Draftwise customers and network access can be globally restricted to only firm IP subnets. We can also deploy to your firm’s existing cloud infrastructure, either in a standard containerized approach (helm chart and private image registry), VM images, or Linux binaries. We can either administer and upgrade the software or provide instructions for firm IT to self-service. Our software can be deployed with a small resource footprint and scaled as usage grows. AI features are not available with this deployment method.

Firms also have the option to deploy on-premise with Draftwise. In this instance, we can easily install or provide installation instructions to your IT leaders for a smooth on-premise deployment. Our support team requires limited access for routine upgrades and 24/7 technical support. AI features are not available with this deployment method.