Epsilon3

Yes. Epsilon3's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Epsilon3 hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Epsilon3's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Epsilon3 is SOC 2 Type II compliant and holds FedRAMP, SOC 2 Type II, NIST CSF, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Epsilon3 hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@epsilon3.io or via a /security page (Epsilon3 lists a security contact).

Epsilon3's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Epsilon3's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Epsilon3's trust center is at https://trust.epsilon3.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Epsilon3 is dedicated to full and complete compliance with all U.S. export control laws and regulations applicable to the conduct of its business, including with respect to the U.S. Department of Commerce’s Export Administration Regulations, codified at 15 CFR 730-774 (EAR), the U.S. Department of State’s International Traffic in Arms Regulations, codified at 22 CFR 120-130 (ITAR), and sanction programs administered by the U.S Department of Treasury’s Office of Foreign Assets Control, codified at 31 CFR 501-598, or the subject of Executive Order. Epsilon3 certifies that its products, including its software-enabled products and related services: * Are appropriately classified as EAR99 under the EAR. * Do not include EAR-controlled “technology” or “software”, as those terms are defined in the EAR (see Part 772), that is classified for U.S. export control purposes more restrictively than EAR99. * Do not contain ITAR-controlled “technical data” as that term is defined in the ITAR (see Part 120.10), or constitute the provision of a “defense service” as that term is defined in the ITAR (see Part 120.9) For more details, see the document on Export Controls Compliance in the Documents section of our Trust Report.

We provide ITAR-compliant cloud hosting via AWS GovCloud. If you want to host your own instance of Epsilon3, we support on-premise deployments. We're also capable of deploying to international AWS regions.

Customer data is secured with 256-bit AES encryption at rest and SSL/TLS encryption in-transit.

Customers can log in with email address/password or with their company SSO credentials.

Yes, for all the major providers (Okta, Microsoft, etc.).

Forever, as long as the customer has a valid, continuing subscription to the service.

Yes, at rest and in transit.

Yes: https://www.epsilon3.io/vulnerability-policy.

Strict contracts with AWS Govcloud AI and LLM sub-processors explicitly prevent using or sharing your data for model training. No customer data or queries are even retained. You also have full control over your team's use of Epsilon3's AI capabilities. Many customers get all the benefits of Epsilon3 without using our AI tools.

Yes, Epsilon3 can be deployed in a classified environment.