Groundswell

We’re pleased to share that Groundswell has successfully completed its SOC 2 Type II examination with an _unqualified_ opinion and _no exceptions noted_ for the third consecutive year. This year’s report covers the Philanthropist Platform System for the period December 5, 2024 through December 6, 2025, and the independent auditor reported “Testing Exceptions: No Exceptions Noted.” This continues a multi-year pattern: - 2024–2025: Unqualified opinion; No Exceptions Noted - 2023–2024: Unqualified opinion; No Exceptions Noted - 2022–2023: Independent service auditor concluded controls operated effectively throughout the period (Dec 1, 2022–Dec 1, 2023). What SOC 2 Type II means for customers SOC 2 Type II evaluates whether security controls are not only designed appropriately, but also operate effectively over an extended period of time. Across all three reporting periods, independent auditors tested Groundswell’s controls and reported no exceptions for the samples tested (e.g., access controls, monitoring/logging, incident response, change management, and business continuity). The updated report is now available within the Vanta Trust Portal under Resources.

As part of Groundswell’s recent migration from AWS to Google Cloud Platform (GCP), we completed a full third-party penetration test to validate our security posture in the new infrastructure. The results came back strong: no low, medium, high, or critical findings were identified. Only a few informational notes were raised, none of which represent risk or require remediation. This is an excellent outcome and a direct reflection of our collective work to ensure a secure migration. This is a clear win for Groundswell and a validation of our continued investment in secure-by-design architecture. The full report has been uploaded to our Vanta Trust Portal for customer review.

We are pleased to announce the successful completion of our 2025 penetration testing activities for both our mobile and web application platforms. These assessments, conducted by Secutor Consulting from April 28 to May 23, 2025, involved comprehensive security evaluations of our production environments, including our mobile apps (iOS and Android) and key web assets (admin.groundswell.io and app.groundswell.io). The tests followed industry-recognized methodologies (OWASP MAS/MASTG and OWASP Web Security Testing Guide v4) and identified several medium and low-risk vulnerabilities, with no high-risk or critical issues discovered. We have addressed our medium vulnerabilities within our Risk Register and evaluated each for applicability to our environment - deeming them low-impact/low-risk. Our proactive approach to application security reflects our ongoing commitment to protecting user data and maintaining a robust cybersecurity posture. We thank our partners and internal teams for their collaboration and continued focus on securing our digital ecosystem.