Is this your company? Buyers are checking Fluidattacks here. Claim fluidattacks.tech free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Fluidattacks
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Fluidattacks is SOC 2 Type II compliant. Fluidattacks also holds SOC 3, ISO 27001, ISO 27701, ISO 27017, ISO 27018, PCI DSS, and GDPR.
About
Our [Continuous Hacking](https://fluidattacks.com/services/continuous-hacking/) is an all-in-one solution that combines our own tools, AI and certified hacking team throughout the entire software development lifecycle to identify security vulnerabilities accurately, keeping false positives and false negatives to a minimum. This customer-facing portal provides a comprehensive overview of our company's security and compliance posture. Show less
Compliance & infrastructure
Hosting
AWS
Documents
33Documents
- Quality PolicyRequest
- Code of ConductRequest
- Privacy Compliance PolicyRequest
- Vulnerability Management PolicyRequest
- Physical Security PolicyRequest
- Password Management PolicyRequest
- Log Management PolicyRequest
- Data Retention PolicyRequest
- Backup PolicyRequest
- Software Development and Change Management PolicyRequest
- Third-Party Management PolicyRequest
- Information Security Roles and Responsibilities PolicyRequest
- Incident Response PolicyRequest
- Human Resource Security PolicyRequest
- Data Management PolicyRequest
- Business Continuity and Disaster Recovery PolicyRequest
- Encryption PolicyRequest
- Access Control PolicyRequest
- Asset Management PolicyRequest
- 00 - IS&PMS Master List of DocumentsRequest
- 01 - IS&PMS ScopeRequest
- 02 - IS&PMS Information Security and Privacy Management System (IS&PMS) PolicyRequest
- 03 - IS&PMS Roles and ResponsibilitiesRequest
- 04 - IS&PMS Risk Assessment and Risk Treatment ProcessRequest
- 05 - IS&PMS Procedure for the Control of Documented InformationRequest
- 06 - IS&PMS Information Security and Privacy Communication PlanRequest
- 07 - IS&PMS Procedure for Internal AuditsRequest
- 08 - IS&PMS Procedure for Management ReviewRequest
- 09 - IS&PMS Procedure for Corrective Action and Continual ImprovementRequest
- 10 - IS&PMS Information Security and Privacy Objectives PlanRequest
- 11 - IS&PMS Statement of ApplicabilityRequest
- 12 - IS&PMS Relevant Laws, Regulations, and Contractual RequirementsRequest
- SaaS responsibility matrixRequest
Subprocessors
20- AAmazon Web Services · Cloud providerUSA
- CCloudflare · Cloud monitoringUSA
- GGoogle Workspace · Identity providerUSA
- OOpenAI · EngineeringUSA
- ZZoho · ITUSA
- VVanta · SecurityUSA
- AAuth0 · Identity providerUSA
- OOkta · Identity providerUSA
- DDatadog · Cloud monitoringUSA
- ddbt Labs · Data analyticsUSA
- VVoyageUSA
- SSnowflake · Database for analytical purposesUSA
Show all 20 subprocessorsShow fewer
- ZZoho Desk · zoho_deskUSA
- GGitLab · Version controlUSA
- ZZoho People · zoho_peopleUSA
- GGoogle Drive · Document managementUSA
- AAnthropic · EngineeringUSA
- KKiflo · Partner Relationship Management (PRM)
- rrudol · Rudol.ai is an end-to-end, AI-driven data quality and governance platform design
- KKandji · Endpoint Secure ManagementUSA
Compliance leadership
The person who leads Fluidattacks's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Fluidattacks's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Fluidattacks SOC 2 compliant?
Fluidattacks is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Fluidattacks SOC 3 compliant?
According to Fluidattacks's public trust center, Fluidattacks is SOC 3 compliant. On SOC2C this listing is Listed.
Is Fluidattacks ISO 27001 certified?
According to Fluidattacks's public trust center, Fluidattacks is ISO 27001 certified. On SOC2C this listing is Listed.
Is Fluidattacks ISO 27701 certified?
According to Fluidattacks's public trust center, Fluidattacks is ISO 27701 certified. On SOC2C this listing is Listed.
Is Fluidattacks ISO 27017 certified?
According to Fluidattacks's public trust center, Fluidattacks is ISO 27017 certified. On SOC2C this listing is Listed.
Is Fluidattacks ISO 27018 certified?
According to Fluidattacks's public trust center, Fluidattacks is ISO 27018 certified. On SOC2C this listing is Listed.
Is Fluidattacks PCI DSS compliant?
According to Fluidattacks's public trust center, Fluidattacks is PCI DSS compliant. On SOC2C this listing is Listed.
Is Fluidattacks GDPR compliant?
According to Fluidattacks's public trust center, Fluidattacks is GDPR compliant. On SOC2C this listing is Listed.
Is Fluidattacks SOC 2 Type I or Type II?
Fluidattacks is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Fluidattacks's SOC 2 for a vendor risk assessment?
Yes. Fluidattacks's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Fluidattacks penetration tested?
Fluidattacks hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Fluidattacks secure?
Security isn't a single yes/no, but Fluidattacks is SOC 2 Type II compliant and holds SOC 2 Type II, SOC 3, ISO 27001, ISO 27701, ISO 27017, ISO 27018, PCI DSS, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Fluidattacks have a bug bounty or vulnerability disclosure program?
Fluidattacks hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@fluidattacks.tech or via a /security page.
Who are Fluidattacks's subprocessors?
Fluidattacks lists 20 subprocessors on its trust center, including Amazon Web Services, Cloudflare, Google Workspace, OpenAI, Zoho. Buyers use this for fourth-party risk review.
Where does Fluidattacks host or store data?
Fluidattacks hosts on AWS. Data residency details are on its trust center.
Where is Fluidattacks's trust center or security page?
Fluidattacks's trust center is at https://trust.fluidattacks.tech. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where can I find information about Fluid Attacks' uptime and downtimes?
This is our Status Page. You can subscribe for updates, view uptimes, be informed of any outages, and view incidents historical data.
Do you have an NDA / Non Disclosure Agreement for your employees?
Yes, you can information about it here.
Do you conduct polygraph tests on your employees?
Yes, Fluid Attacks conduct polygraph tests on its employes. The description about them can be found in the following link.
Do you encrypt data at rest?
The details about data encryption at rest are available in this link.
Do you encrypt data in transit?
The details about data encryption at rest are available in this link.
What is the communication service between Fluid Attacks and its clients?
Our Help Channel is designed to address inquiries, concerns, and requests, including developer role changes and access permission modifications.
How do you manage your secrets rotation?
The best way to prevent key leakage is by changing keys regularly. In this link, you will find more information about it.
What kind of services/applications do you use for monitoring your stack?
We use different types of monitoring tools. We have implemented these services to monitor our own stack.
Is there an incident management process implemented?
Yes, we have an incident management and resolution process. In this process, issues include malfunctions, performance degradation, service disruptions, or errors within Fluid Attacks products or components. These issues must have already affected or have the potential to impact a minimum of two users, regardless of whether they have been reported or not. This criterion applies universally, including internal issues affecting hackers or other team members. Details related to this process can be found here.
Do you have an ethics hotline available for employees and external parties?
Yes, we have enabled an ethics hotline (Anonymous Reporting) for employees and external parties. Through that website, users can send us feedback about harassment, retaliation, and other issues they have experienced or witnessed concerning other people. In addition, recommendations and questions can be sent, among other information, without revealing the name (this is optional), being completely confidential. More details can be found here.
What is your log management process or strategy?
Our log management strategy is defined here systems and applications.
Do you have a established a backup recovery objectives?
Yes, our platform's backups are always generated in full. Database has daily, weekly, quarterly and annual full backup schedules. If you want to see a more detailed information, please refer to this link.