Hasura

Hasura is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Hasura's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Hasura hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Hasura's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Hasura publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Hasura is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Hasura hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@hasura.io or via a /security page (Hasura lists a security contact).

Hasura lists 26 subprocessors on its trust center, including Amazon Web Services, Google Cloud Platform, Cloudflare, Zendesk, Microsoft Azure. Buyers use this for fourth-party risk review.

Hasura hosts on AWS, GCP, Azure, and handles Customer personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Hasura's trust center is at https://trust.hasura.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Hasura values and prioritizes data privacy and security within our products. Our suite of applications contain self-hosted, cloud, and hybrid offerings. The data is collected as needed to provide the intended services, remains limited, and dependent on the selected offering. For reference, please review our Privacy policy here: https://hasura.io/legal/hasura-privacy-policy

Hasura maintains servers in various countries around the world, currently in Singapore, Ireland, Belgium, France, India, UK, Germany, Australia, Canada, Japan and the United States.

The Personal Information that you provide, subject to disclosure in accordance with this Policy, shall be maintained in a safe and secure manner. Hasura databases and information are stored on secure servers with appropriate firewalls and physical and electronic safeguards. Hasura uses industry standard physical, technical and administrative security measures designed to safeguard all Personal Information and keep it confidential and secure. We conduct periodic reviews of our security measures pertaining to our Personal Information collection, storage, to guard against unauthorized access to systems. For additional information, reference our security documentation including the SOC 2 Type 2 report.

Hasura has an internal bug bounty program. Please reference our Security Vulnerable Disclosure Protocol here for instructions: https://hasura.io/docs/latest/policies/security-disclosure/

Yes, and we can enter into a DPA with our enterprise customers as applicable. Our DPA is linked here: https://hasura.io/legal/hasura-data-processing-addendum