Is this your company? Buyers are checking By clicking here. Claim factory.ai free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
By clicking
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
By clicking is SOC 2 Type II compliant. By clicking also holds ISO 42001, and CCPA.
About
Welcome to our Trust Portal for Factory - your portal to understanding our unwavering commitment to data security, privacy, and compliance. Here, you can access our compliance documentation, find answers to frequently asked questions related to security and privacy, and explore our robust security practices. We believe in maintaining transparency and building trust with our customers, and this portal is designed to provide you with the information and assurance you need to feel confident in our ability to protect your data.
Compliance & infrastructure
Hosting
AWSGCPAzure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health informationCode Metadata
Documents
7Subprocessors
16- MMicrosoft Azure · Cloud provider
- AAmazon Web Services · aws
- GGoogle Cloud Platform · gcp
- GGitHub · github
- AAnthropic · Processing AI requests
- AAxiom · Analytics and log analysis
- FFireworks · Engineering
- GGoogle Drive · Document management
- MMongoDB · Data storage and processing
- OOpenAI · Processing AI requests
- OOrb · Billing
- SSentry · Analytics and log analysis
Show all 16 subprocessorsShow fewer
- SSlack · Collaboration
- SStripe · Billing
- VVercel · Web application hosting
- WWorkOS · User authentication
Compliance leadership
The person who leads By clicking's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. By clicking's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
New subprocessor: MongoDBJun 2026
We are contracting with MongoDB to store usage data.
New subprocessor: BasetenJun 2026
We are contracting with Baseten to provide AI model processing functions to our customers.
New subprocessor: Second FrontJun 2026
We are contracting with Second Front to provide FedRamp hosting for government customers.
New subprocessor: FireworksMar 2026
We have contracted with Fireworks to provide AI model processing functions to our customers.
New subprocessor: AnthropicMar 2026
We have contracted with Anthropic to provide AI model processing functions to our customers.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is By clicking SOC 2 compliant?
By clicking is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is By clicking ISO 42001 certified?
According to By clicking's public trust center, By clicking is ISO 42001 certified. On SOC2C this listing is Listed.
Is By clicking CCPA compliant?
According to By clicking's public trust center, By clicking is CCPA compliant. On SOC2C this listing is Listed.
Is By clicking SOC 2 Type I or Type II?
By clicking is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use By clicking's SOC 2 for a vendor risk assessment?
Yes. By clicking's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is By clicking penetration tested?
By clicking hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get By clicking's SOC 2 report?
By clicking's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Does By clicking have an ISO 27001 certificate?
By clicking publishes an ISO certificate on its trust center; you can request access through SOC2C.
Is By clicking secure?
Security isn't a single yes/no, but By clicking is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 42001, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does By clicking have a bug bounty or vulnerability disclosure program?
By clicking hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@factory.ai or via a /security page (By clicking lists a security contact).
Who are By clicking's subprocessors?
By clicking lists 16 subprocessors on its trust center, including Microsoft Azure, Amazon Web Services, Google Cloud Platform, GitHub, Anthropic. Buyers use this for fourth-party risk review.
Where does By clicking host or store data?
By clicking hosts on AWS, GCP, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is By clicking's trust center or security page?
By clicking's trust center is at https://trust.factory.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by By clicking
Reproduced from By clicking's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
How is my code and data protected in your infrastructure?
Our infrastructure is built with security-first principles: - All infrastructure is defined as code using Terraform, ensuring consistent and secure deployments - Resources are deployed in a Virtual Private Cloud (VPC) with private subnets - Security groups strictly control access between components - All data is encrypted at rest using AWS KMS and in transit using TLS - DynamoDB tables use server-side encryption - S3 buckets are configured with strict access controls and encryption - ECS tasks run in private subnets with minimal required permissions
What security measures are in place for your deployments?
Our Kubernetes infrastructure includes: - Separate control plane and data plane clusters for isolation - Private subnets for worker nodes - IAM roles with least privilege principles - Prometheus monitoring for security metrics - Regular security patches and updates - Network policies controlling pod-to-pod communication
How do you handle logging and monitoring?
We employ comprehensive logging and monitoring: - Prometheus and Grafana for metrics monitoring - CloudWatch for AWS service monitoring - Firehose for log aggregation - Sentry for error tracking and performance monitoring - Regular log analysis for security events
What data do you collect and store?
We manage: - Repository metadata (file paths, function signatures, class definitions) - User authentication information - Organization configuration data - Usage metrics and telemetry - Session data for active users We do NOT store: - Complete source code from repositories - Sensitive credentials or secrets - Personal information beyond what's necessary for service operation
How is data isolated between organizations?
We ensure strict data isolation through: - Separate DynamoDB tables per environment - Organization-specific S3 buckets - IAM roles and policies enforcing access boundaries - Firestore security rules preventing cross-organization access - Kubernetes namespace isolation for organization workloads
What happens to my data if I delete my account?
Upon account deletion: - Organization data is removed from DynamoDB tables - Associated S3 buckets are cleared - Firestore records are deleted - Authentication tokens are revoked - All cached data is purged from our systems
How do you manage access to your systems?
We implement multiple layers of access control: - WorkOS for organization authentication - Firebase Authentication for user management - IAM roles and policies for AWS resources - RBAC for Kubernetes clusters - VPC endpoints for private AWS service access - Multi-factor authentication for administrative access
How do you protect against unauthorized access?
Protection measures include: - Regular security audits - Automated vulnerability scanning - IP whitelisting for sensitive endpoints - Rate limiting on API endpoints - Session management with automatic timeouts - Continuous monitoring for suspicious activities
What security standards do you follow?
We align with industry best practices: - SOC 2 Compliance - ISO 42001 Compliance - Following AWS Well-Architected Framework - Implementing OWASP security guidelines - Regular security assessments - Continuous compliance monitoring through Vanta
How do you handle security incidents?
Our incident response process includes: - Automated alerts for suspicious activities - Dedicated security response team - Incident classification and prioritization - Regular incident response drills - Post-incident analysis and improvements - Customer notification when required
How often do you perform security updates?
We maintain a proactive security posture: - Daily automated security scans - Weekly dependency updates - Monthly infrastructure security reviews - Quarterly penetration testing - Immediate critical patch deployment - Regular security training for team members
How can I report a security vulnerability?
If you discover a security vulnerability: 1. Email our CTO directly at [eno@factory.ai](mailto:eno@factory.ai) 2. Include detailed information about the vulnerability 3. Avoid sharing sensitive details publicly 4. Our security team will acknowledge within 24 hours 5. We'll provide regular updates on investigation progress 6. You'll receive confirmation when the issue is resolved
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public