Question 1

Is Go1 SOC 2 compliant?

Accepted Answer

Go1 is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Go1 ISO 27001 certified?

Accepted Answer

According to Go1's public trust center, Go1 is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Go1 SOC 2 Type I or Type II?

Accepted Answer

Go1 is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Go1's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Go1's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Go1 penetration tested?

Accepted Answer

Yes — Go1 undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Question 6

Does Go1 have a penetration test report?

Accepted Answer

Go1 publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Question 7

Is Go1 secure?

Accepted Answer

Security isn't a single yes/no, but Go1 is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Go1 have a bug bounty or vulnerability disclosure program?

Accepted Answer

Go1 hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@go1.com or via a /security page (Go1 lists a security contact).

Question 9

Who are Go1's subprocessors?

Accepted Answer

Go1's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Question 10

Where does Go1 host or store data?

Accepted Answer

Go1's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Question 11

Where is Go1's trust center or security page?

Accepted Answer

Go1's trust center is at https://trust.go1.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

Can we encrypt our data in the Go1 platform with our own encryption key?

Accepted Answer

No, currently Go1 does not support BYOK (Bring Your Own Key).

Question 13

Do you support Single Sign-On (SSO)?

Accepted Answer

Yes, Go1 supports SSO common providers we support are Azure AD, Google and Okta. Please see our FAQ page on SSO

Question 14

What are Go1's whitelisting requirements?

Accepted Answer

Go1 is an aggregator of content and has content hosted by Go1 and by 3rd parties. Domains required for Go1-hosted content (and other platform services) can be found here: Domain Whitelisting | Go1.

Question 15

Is there a client app that needs to be downloaded to access Go1?

Accepted Answer

No - Go1 is a web-based application, and would only need permission through your company firewall.

Question 16

Does the Go1 platform use a Web Application Firewall (WAF)?

Accepted Answer

Yes, all ingress traffic to the Go1 platform passes through Cloudflare where we have a WAF configured.

Question 17

What data export features are available with Go1?

Accepted Answer

Customers can export data from Go1 using built-in tools available via the Go1 admin interface, including reports on user logins, enrolments, and learning activity. These reports can be customised using filters such as course, date range, and user, and exported in CSV format. For programmatic access, developers can use Go1’s RESTful API. For real-time data syncing, Go1 also provides support for event-based integrations through Go1’s webhooks. Please note that while Go1 retains internal application and security logs, these are not made available for export.

Question 18

Do you have a Data Protection Officer (DPO)?

Accepted Answer

Go1 has a dedicated in-house InfoSec and Privacy team, but does currently not have an appointed DPO. In order to provide our customers and users in the EU (the geographical scope of the GDPR) with a direct point of contact, we have Oakland Group as EU representative (in accordance with Art. 27 GDPR).

Question 19

Where is our data hosted and Is it possible to store PII in a specific geographic/geopolitical region?

Accepted Answer

Go1 processes and stores data in Microsoft Azure data centers located in Australia (AustraliaEast), the US(Central US), and the EU (NorthEurope). A customer is able to select a single region needed. Data may be transferred out of that region (please see answer below on personal data flow).

Question 20

What types of PII do you collect?

Accepted Answer

The primary PII we collect is: * First name * Last name * Email address The types of data we collect is covered under our Privacy Policy under Information Collection and Processed.

Question 21

What types of data do you collect?

Accepted Answer

The types of data we collect is covered under our Privacy Policy under Information Collection and Processed.

Question 22

Do you encrypt data at rest?

Accepted Answer

Yes, all data (including backups) are encrypted at rest using AES256.

Question 23

Do you encrypt data in transit?

Accepted Answer

Yes, all data is encrypted in transit using TLS 1.2 or 1.3.

Go1

About

Compliance & infrastructure

Documents

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Education peers that completed SOC 2

Mentor Collective

Apperson Inc

Mgkusumaputra

Prodigy Education