Is this your company? Buyers are checking Effi here. Claim effi.com.au free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Effi
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Effi is SOC 2 Type II compliant.
About
Effi is the smartest lead management platform for mortgage brokers, mortgage managers and lenders in Australia. With advanced workflows and automation pre-built, Effi assists businesses to stay on top of their leads with AI-powered SMSbot to engage your cold leads or backbook for annual reviews.
Compliance & infrastructure
Hosting
AWSGCPAzure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
6Subprocessors
9- AAmazon Web Services · Cloud provider
- CConfluence · Document management
- GGitHub · Version control
- GGoogle Cloud Platform · Cloud provider
- JJira · Collaboration
- MMessageMedia
- MMicrosoft Azure · Cloud provider
- MMongoDB Atlas · Data storage and processing
- NNylas · Engineering
Compliance leadership
The person who leads Effi's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Effi's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
6/11 details · 55%SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Effi SOC 2 compliant?
Effi is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Effi SOC 2 Type I or Type II?
Effi is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Effi's SOC 2 for a vendor risk assessment?
Yes. Effi's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Effi penetration tested?
Effi hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Effi's SOC 2 report?
Effi's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Effi secure?
Security isn't a single yes/no, but Effi is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Effi have a bug bounty or vulnerability disclosure program?
Effi hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@effi.com.au or via a /security page (Effi lists a security contact).
Who are Effi's subprocessors?
Effi lists 9 subprocessors on its trust center, including Amazon Web Services, Confluence, GitHub, Google Cloud Platform, Jira. Buyers use this for fourth-party risk review.
Where does Effi host or store data?
Effi hosts on AWS, GCP, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is Effi's trust center or security page?
Effi's trust center is at https://trust.effi.com.au. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Do you encrypt data at rest?
Yes. All customer data stored in our cloud databases and object storage is encrypted at rest using industry-standard encryption. Data in transit is also encrypted in line with our Cryptography Procedure.
How do you handle the data we collect?
We follow a least-privilege access model and only allow authorized systems and employees to access data. Data is processed in secure containers and serverless functions, with encryption at every stage. Access is logged and monitored.
How do you process and protect data within your applications?
Our applications run in containers and serverless functions. This ensures scalability, isolation, and security, while encryption keeps data protected during processing.
Want to report a potential security issue?
Yes, we encourage responsible disclosure. Security issues can be reported to our security team at support@effi.com.au We will promptly review and respond.
I found a security bug. Do you have an established bug bounty program?
Currently, we do not operate a public bug bounty program. However, we welcome responsible disclosures and address reported vulnerabilities promptly through our internal security processes
What privacy/security settings are available?
We enforce: - Role-based access control (RBAC) - Multi-factor authentication (MFA) for remote access - Strict password policies (length, complexity, expiration, lockouts) - Session management & access logging
Do you support Single Sign-On (SSO)?
Yes. We support Single Sign-On (SSO) through Microsoft, making it easier and safer for users to access our systems.
Where are your servers located?
All customer data is stored in security-accredited cloud data centres within Australia, ensuring compliance with Australian data sovereignty requirements
How is your infrastructure secured?
Our infrastructure is hosted in security-accredited cloud environments, protected with network segmentation, firewalls, intrusion prevention systems, and continuous monitoring. Production, staging, and development environments are separated to minimize risk.
How do you monitor for security breaches?
We use continuous monitoring, logging, and real-time alerts. Suspicious activity is flagged instantly, allowing our security team to respond immediately
How do you handle identified vulnerabilities?
Our vulnerability management process includes scanning, prioritization, and remediation. We apply patches quickly to keep systems protected.
Do you regularly test your systems for security issues?
Yes. We conduct frequent vulnerability scans, penetration testing, and compliance checks. All findings are patched promptly in line with our vulnerability management program.
Business & Industrial peers that completed SOC 2
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public