Is this your company? Buyers are checking Figment here. Claim figment.io free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Figment
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Figment is SOC 2 Type II compliant. Figment also holds ISO 27001.
About
Security First | Risk Mitigation | Slashing Prevention Figment's multi-layered security approach encompasses continuous proactive measures and purpose built controls to maximize the resiliency and security of its staking services. Security is integrated throughout all aspects of Figment to reduce risk and enable the assurance, integrity and confidentiality customers expect.
Compliance & infrastructure
Compliance leadership
The person who leads Figment's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Figment's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
4/11 details · 36%SOC2C shows the verified essentials. 7 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Figment SOC 2 compliant?
Figment is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Figment ISO 27001 certified?
According to Figment's public trust center, Figment is ISO 27001 certified. On SOC2C this listing is Listed.
Is Figment SOC 2 Type I or Type II?
Figment is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Figment's SOC 2 for a vendor risk assessment?
Yes. Figment's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Figment penetration tested?
Figment hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Figment secure?
Security isn't a single yes/no, but Figment is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Figment have a bug bounty or vulnerability disclosure program?
Figment hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@figment.io or via a /security page (Figment lists a security contact).
Who are Figment's subprocessors?
Figment's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Figment host or store data?
Figment's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Figment's trust center or security page?
Figment's trust center is at https://trust.figment.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Figment
Reproduced from Figment's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
How can I get a copy of Figment's most recent audit attestations?
Figment's SOC 2 Type 2 Audit Report and ISO 27001:2013 Certificate can be requested under "Resources" or in the Compliance section of the Overview page.
Does Figment have slashing event coverage?
For slashing and downtime penalties, Figment's off-the-shelf coverage generally covers up to 6-months worth of fees earned from the customer and 3-months worth of fees earned for missed rewards, annually.
How does Figment safeguard against DDoS attack at the Protocol level?
The PoS network protocol itself provides security against DDoS attacks. Being a decentralized network means that there is no single point-of-failure that can be attacked. However, if necessary Figment will add more relay nodes until the attack is over.
How does Figment safeguard against DDoS attacks on a validator node?
Figment has designed its networks to be dynamic and scalable. If a node is under attack, that node will be migrated elsewhere. Taking advantage of the distributed nature of blockchain data will not be lost and the migration will be seamless.
How does Figment safeguard against DDoS attacks?
Figment uses a DNS provider and failover design that monitors for DDoS attacks and can mitigate on the global network level.
How does Figment secure keys?
Key management capabilities are dependent on blockchain and either generated directly onto an encrypted FIPS 140-2 physical device restricted to custodians, or stored in a zero-trust vault solution.
What are Figment's security measures against validator nodes?
Figment utilizes a threat management approach and works closely with the PoS network protocol developers to get first-hand information about security threats, Red Team pre-emptive attack scenarios, enforcement of industry standard hardening practices and security and performance monitoring.
What happens if one validator node is compromised and what is the exposure for the others?
Each node runs completely independent of each other, at a bare minimum in a different private network. In the unlikely event that a node is compromised, the other nodes will not be affected.
What is monitored on the validator node and blockchain?
At the node level we monitor: * VM monitoring * CPU Disk * Memory Disk Usage * Network Line speed At the blockchain level we monitor: * Block Height * Peer Count * Number of transactions sent to a node * Number of transactions pending in txpool * Number of queued transactions in txpool
What security measures does Figment take to ensure the security of its staking services?
Figment utilizes a proactive zero-trust architecture approach that enforces the following high-level controls: * Access authentication, MFA and privileged monitoring * Vendor and industry hardening * Perimeter protections * End-point protections and host checking * Strong encryption methods * Strict key custodian management * Secure development * Continuous vulnerability management * Security 24/7 monitoring and alerting * ISO 27001 and SOC 2 audit frameworks Additionally, Figment has a dedicated security team that manages threats and enforces controls utilizing a risk-approached model.
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public