By clicking

By clicking hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

By clicking's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

By clicking publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but By clicking is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 42001, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

By clicking hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@factory.ai or via a /security page (By clicking lists a security contact).

By clicking lists 16 subprocessors on its trust center, including Microsoft Azure, Amazon Web Services, Google Cloud Platform, GitHub, Anthropic. Buyers use this for fourth-party risk review.

By clicking hosts on AWS, GCP, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

By clicking's trust center is at https://trust.factory.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Our infrastructure is built with security-first principles: - All infrastructure is defined as code using Terraform, ensuring consistent and secure deployments - Resources are deployed in a Virtual Private Cloud (VPC) with private subnets - Security groups strictly control access between components - All data is encrypted at rest using AWS KMS and in transit using TLS - DynamoDB tables use server-side encryption - S3 buckets are configured with strict access controls and encryption - ECS tasks run in private subnets with minimal required permissions

Our Kubernetes infrastructure includes: - Separate control plane and data plane clusters for isolation - Private subnets for worker nodes - IAM roles with least privilege principles - Prometheus monitoring for security metrics - Regular security patches and updates - Network policies controlling pod-to-pod communication

We employ comprehensive logging and monitoring: - Prometheus and Grafana for metrics monitoring - CloudWatch for AWS service monitoring - Firehose for log aggregation - Sentry for error tracking and performance monitoring - Regular log analysis for security events

We manage: - Repository metadata (file paths, function signatures, class definitions) - User authentication information - Organization configuration data - Usage metrics and telemetry - Session data for active users We do NOT store: - Complete source code from repositories - Sensitive credentials or secrets - Personal information beyond what's necessary for service operation

We ensure strict data isolation through: - Separate DynamoDB tables per environment - Organization-specific S3 buckets - IAM roles and policies enforcing access boundaries - Firestore security rules preventing cross-organization access - Kubernetes namespace isolation for organization workloads

Upon account deletion: - Organization data is removed from DynamoDB tables - Associated S3 buckets are cleared - Firestore records are deleted - Authentication tokens are revoked - All cached data is purged from our systems

We implement multiple layers of access control: - WorkOS for organization authentication - Firebase Authentication for user management - IAM roles and policies for AWS resources - RBAC for Kubernetes clusters - VPC endpoints for private AWS service access - Multi-factor authentication for administrative access

Protection measures include: - Regular security audits - Automated vulnerability scanning - IP whitelisting for sensitive endpoints - Rate limiting on API endpoints - Session management with automatic timeouts - Continuous monitoring for suspicious activities

We align with industry best practices: - SOC 2 Compliance - ISO 42001 Compliance - Following AWS Well-Architected Framework - Implementing OWASP security guidelines - Regular security assessments - Continuous compliance monitoring through Vanta

Our incident response process includes: - Automated alerts for suspicious activities - Dedicated security response team - Incident classification and prioritization - Regular incident response drills - Post-incident analysis and improvements - Customer notification when required

We maintain a proactive security posture: - Daily automated security scans - Weekly dependency updates - Monthly infrastructure security reviews - Quarterly penetration testing - Immediate critical patch deployment - Regular security training for team members

If you discover a security vulnerability: 1. Email our CTO directly at [eno@factory.ai](mailto:eno@factory.ai) 2. Include detailed information about the vulnerability 3. Avoid sharing sensitive details publicly 4. Our security team will acknowledge within 24 hours 5. We'll provide regular updates on investigation progress 6. You'll receive confirmation when the issue is resolved