Is this your company? Buyers are checking Exalate here. Claim exalate.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Exalate
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Exalate is SOC 2 compliant. Exalate also holds ISO 27001.
About
Our mission at Exalate is to make collaboration easy across teams and company borders by providing a secure, scalable integration that bridges the gap between systems.
Compliance & infrastructure
Documents
7Subprocessors
5- GGoogle LLC · Web Analytics, Cloud Hosting1600 Amphitheatre Parkway, Mountain View, CA 94043, USA
- rrsync.net, Inc. · Storage of encrypted off-site backup524 San Anselmo Ave. Suite 107, San Anselmo, CA 94960, USA
- HHubspot, Inc. · CRM2 Canal Park, Cambridge, MA 02141 USA
- OOpenAI · Process integration scripts to identify and suggest improvements3180 18th Street, San Francisco, CA 94110 USA
- DDatacenter United · Data Center ProviderHaïfastraat 6, 2030 Antwerp, Belgium
Compliance leadership
The person who leads Exalate's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Exalate's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Exalate SOC 2 compliant?
Exalate is SOC 2 compliant. On SOC2C this listing is Listed.
Is Exalate ISO 27001 certified?
According to Exalate's public trust center, Exalate is ISO 27001 certified. On SOC2C this listing is Listed.
Can I use Exalate's SOC 2 for a vendor risk assessment?
Yes. Exalate's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Exalate penetration tested?
Exalate hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Does Exalate offer a Data Processing Agreement (DPA)?
Exalate publishes a DPA on its trust center; you can request access through SOC2C.
Is Exalate secure?
Security isn't a single yes/no, but Exalate is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Exalate have a bug bounty or vulnerability disclosure program?
Exalate hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@exalate.com or via a /security page (Exalate lists a security contact).
Who are Exalate's subprocessors?
Exalate lists 5 subprocessors on its trust center, including Google LLC, rsync.net, Inc., Hubspot, Inc., OpenAI, Datacenter United. Buyers use this for fourth-party risk review.
Where does Exalate host or store data?
Exalate's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Does Exalate offer a Data Processing Agreement (DPA)?
Exalate publishes a DPA on its trust center. You can request access through SOC2C.
Where is Exalate's trust center or security page?
Exalate's trust center is at https://trust.exalate.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Exalate
Reproduced from Exalate's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
The Exalate Approach to Security
At Exalate we base our security approach on three dimensions: - Security by Design Security vulnerability scanning has been implemented at every stage of the development, deployment, and operation of the solution. This scanning is based on the solutions provided by Aikido, which allow highlighting the security problems from the moment a developer types a line of code. - Advanced Endpoint detection and response (EDR) monitored by a 24/7 SOC EDR is implemented through a combination of the Palo Alto Cortex XDR solution, a 24/7 manned SOC for addressing incidents and vulnerabilities, and the Security Command Center to guard the Exalate cloud environment. - Process and policies focused on increasing the security awareness of the whole team All policies related to the ISO27001 standard have been implemented and are controlled by various processes. Roles and responsibilities are defined and assigned to various people in the team. These policies include: - Acceptable use - Privacy and Employee privacy - Security awareness training for all the employees - HR recruitment - The Incident, Vulnerability, and Change management - Risk management While we can address the specific security concerns customers might have based on their use cases, the following is a list of the most commonly asked questions.
Is Exalate ISO certified?
Exalate is ISO27001:2022 certified. This means that all the conditions for achieving this certification have been implemented. Evidence of the auditing process and the certificate can be provided upon request.
Is Exalate SOC2 compliant?
As part of our ongoing improvements to our security program, we will soon proceed with the SOC2 certification.
Is Exalate GDPR Compliant?
Exalate has its HQ in Europe (Belgium) and therefore complies with all GDPR-related legislation.
What is the benefit of Exalate's single-tenant architecture compared to a multi-tenant one?
A single-tenant application, in the context of integration software, is an application that is related to only one system. A multi-tenant application on the other hand allows using one infrastructure to connect with multiple systems. So, whenever considering an integration solution, one should pay attention to the tenancy of the proposition. All software has bugs, either because of improper development, configuration mistakes, or any other reason. The recent breaches at LastPass and Octa show that protecting information is a Herculean task. Integration software is more complex as it needs to take care of many diverse aspects and information paths. To minimize the risk of information leakage, a single-tenant architecture is a much better option as it allows us to contain information leaks at the infrastructure level. When an Exalate node is deployed on the Exalate Cloud, it is running inside a ‘Kubernetes pod’ that is configured to ensure no information can leak. The maintenance of this Exalate Cloud is fully based on the principles of ‘Infrastructure as Code’. There is no manual configuration for the environment.
How is Exalate Cloud protected?
All clusters are protected by state-of-the-art Endpoint Detection and Response (EDR) systems, specifically the ‘Cortex MDR’, from Palo Alto. This infrastructure is monitored round-the-clock by a Security Operations Center (SOC) staffed by Cyber Security engineers. The monitoring service, provided by NVISO, has been validated by a MITRE ATT&CK test.
How is the Data Secured on the Exalate Server for Jira Cloud?
Atlassian requires that any 'add-on' technology runs on a separate server. This is called Atlassian Connect. Relevant data for the functioning of the add-on will be exchanged with the vendors' servers. The same applies to Exalate. Whenever an issue is updated, a webhook will be called. It triggers the Exalate logic to collect all relevant data such as specified in the outgoing sync processor (Sync Rules). This communication is secured via HTTPS and JWT. In case _the Destination side is on the private network_ the issue data resides on the Exalate Cloud servers until the destination Jira instance requests for any changes. These changes will then be sent to the Jira Server - and that communication is normally also secured via HTTPS. The information on the Exalate cloud server is removed. In case _the Destination side is publicly accessible_ the issue data resides on the Exalate Cloud server until the app filters and processes changes. These changes will then be sent to the Destination Jira Instance - and that communication is normally also secured via HTTPS. The information on the Exalate cloud server is removed. Contrary to the common implementation model as prescribed by Atlassian, Exalate cloud apps are single-tiered. Meaning - that the operation and handling of the data are fenced from any other interference.
Can Exalate be integrated with an SSO Solution?
Exalate performs authentication through the underlying platform (e.g. Jira). Whenever there is a need to log into the application, Exalate will check with the platform if the authenticated user is authorized to perform configuration tasks or not. The authentication protocol is either 'Basic Authentication' or 'Oauth' based. Since Exalate doesn’t have a user directory concept, there is no need for an SSO Solution integration.
Does anyone have access to my data?
Access to the application is defined by the underlying system and is fully configured by the administrator of that platform. When deployed on Exalate Cloud, our support engineers and cloud operators can have access to the data, but only after explicit approval by the customer. All our staff goes through background checks, and only a well-identified list of employees with appropriate clearances can access your information.
Who has access to the data used by the AI?
Access to the data processed by AI is strictly limited to authorized personnel. Additionally, access to logs and interactions with the AI feature is restricted and monitored to ensure compliance with security policies.
How does Exalate encrypt my data?
Any customer data in the Exalate cloud is encrypted in transit and at rest. Offline backups are encrypted for each tenant. Furthermore, Exalate Cloud ensures that every node is totally separated from any other node, including computing resources, file storage, database storage, and network path.
What encryption method does Exalate use?
Exalate uses the Transport Layer Security (_TLS_) Protocol Version _1.3. If the issue tracker does not support this version, we use TLS 1.2._
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public