Is this your company? Buyers are checking Epic River here. Claim epicriver.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Epic River
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Epic River is SOC 2 Type II compliant. Epic River also holds NIST CSF.
About
Epic River empowers community banks and credit unions to leverage their trusted relationships with local businesses to make digital loans an easy and accepted method of payment. Epic River was founded in 2005 to deliver a cloud-hosted platform to community banks and credit unions across the United States to help them compete with non-bank lenders. With a focus on the intersection of financial services and healthcare, Epic River places top priority on the security of code, data, infrastructure and our team members.
Compliance & infrastructure
SOC 2 Type IINIST CSF
Hosting
AWS
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
22Documents
- 2025 SOC 2 Type 2 Report.pdfRequest
- W9 & Certificate of Good StandingRequest
- Kinective - 2024 OSP Hamilton Holdings FS_Redacted 051425.pdfRequest
- Kinective - COI.pdfRequest
- Penetration testRequest
- Epic River AWS-security-report-certificate.pdfRequest
- Kinective - IR Plan.pdfRequest
- Kinective - 2025 Information Security Policy.pdfRequest
- Kinective - 2025 DRP Test Results.pdfRequest
- Kinective - 2025 DRP.pdfRequest
POLICIES
- Business Continuity and Disaster Recovery PlanRequest
- Information Security Policy (AUP)Request
- Data Management PolicyRequest
- Cryptography PolicyRequest
- Incident Response PlanRequest
- Access Control PolicyRequest
- Secure Development PolicyRequest
- Risk Management PolicyRequest
- Operations Security PolicyRequest
- Third-Party Management PolicyRequest
- Physical Security PolicyRequest
- Code of ConductRequest
Subprocessors
2- AAmazon Web Services · aws
- IIDology
Compliance leadership
The person who leads Epic River's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Epic River's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Epic River SOC 2 compliant?
Epic River is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Epic River NIST CSF compliant?
According to Epic River's public trust center, Epic River is NIST CSF compliant. On SOC2C this listing is Listed.
Is Epic River SOC 2 Type I or Type II?
Epic River is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Epic River's SOC 2 for a vendor risk assessment?
Yes. Epic River's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Epic River penetration tested?
Epic River hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Epic River's SOC 2 report?
Epic River's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Epic River secure?
Security isn't a single yes/no, but Epic River is SOC 2 Type II compliant and holds SOC 2 Type II, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Epic River have a bug bounty or vulnerability disclosure program?
Epic River hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@epicriver.com or via a /security page (Epic River lists a security contact).
Who are Epic River's subprocessors?
Epic River lists 2 subprocessors on its trust center, including Amazon Web Services, IDology. Buyers use this for fourth-party risk review.
Where does Epic River host or store data?
Epic River hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is Epic River's trust center or security page?
Epic River's trust center is at https://diligence.epicriver.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where can I find Epic River's Privacy Policy?
Epic River's privacy policy can be accessed by the link below or via footer navigation on all pages of it's public marketing website. https://epicriver.com/privacy-policy/
How do you detect/prevent transfer/communication of sensitive information through email or via web-based document sharing portals such as DropBox or Google Docs?
Sensitive information can not be accessed by any employees, other than the InfoSec Team, via any terminal, mobile device or other devices that allows access to file sharing sites, email or chat applications. This configuration can only be modified by the InfoSec Team. Any attempt by an employee to modify this configuration will result in notification of InfoSec Team. Any configuration modification will result in a notification to the entire InfoSec Team.
What is the frequency and method of employee information security training?
Annually, all employees complete information security training and are tested on their knowledge. Monthly, all employees complete updated information security awareness training and are quizzed on the information. Two weeks after each monthly security awareness training, all employees receive an infographic re-inforcing the information presented in the monthly training session.
What insurance policies does Epic River maintain?
Epic River maintains the following insurance policies: - Commercial General Liability - Directors and Officers Liability - Technology Errors & Omissions (Cyber Security) Liability - Employment Practices Liability
Are any portions of the products and/or services Epic River provides performed or hosted outside the United States?
No.
Does the organization have any operations based in a foreign country, does any data reside in a foreign country, or do you utilize any off-shore third-party service providers?
No.
Has Epic River had a breach of sensitive information in the last 3 years?
No.
Does Epic River conduct background checks of all employees as part of the hiring process?
Yes
Are Epic River employees aware of our information security expectations and periodically trained on our policies, procedures, and new security threats?
Yes. All Epic River employees are required to complete annual security training as well as monthly security threat awareness training. In additional, all team members review and agree to all policies annually as well as upon any material alteration to policies.
Does Epic River provide audited or reviewed financials?
As a closely held private entity, we do not provide our financials, however, we do provide a signed statement of financial condition that usually satisfies the underlying risk concerns.
Is there a publicly accessible page showing the status of the service?
Yes, the service health dashboard can be found here - https://knowledge.epicriver.com/knowledge/service-health-dashboard
