Is this your company? Buyers are checking Heartpace here. Claim heartpace.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Heartpace
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Heartpace is SOC 2 compliant. Heartpace also holds ISO 27001, and GDPR.
About
Heartpace delivers a smooth, smart, and secure HRM System to the European market. Heartpace is part of Söderberg & Partners HR Tech business area, S & P Compensation & Benefits Consulting. The business area was established in early 2017 and offers consultancy services, resource support pension and insurance benefits tools, control of personnel costs, and employability. Söderberg & Partners was founded in 2004 and is one of Sweden’s leading independent advisors and intermediaries of insurance and financial products with one of the largest independent research departments in the Nordic region. T
Compliance & infrastructure
Hosting
AWS
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
16Documents
- ISO 27001:2022 Certificate - British Assessment BureauPublic
- DORA ComplianceRequest
- IT Infrastructure and security presentationRequest
- Heartpace security structure version 27Request
- Heartpace SLARequest
- 11-ISMS Statement of ApplicabilityRequest
- PentestRequest
- Insurance certificateRequest
- ISMS 11 - Statement of Applicability (SoA) HeartpaceRequest
- Independent review of cryptographic key managementRequest
- AI Use PolicyRequest
- Pentest 2026.pdfRequest
- Heartpace - DORA Compliance Attestation.pdfRequest
Subprocessors
4- AAmazon Web Services · Cloud providerStockholm-Sweden, Dublin-Ireland
- IIntercom · Customer supportEU
- SStartdeliver AB · CSMEU
- HHetzner · Cloud providerGermany
Compliance leadership
The person who leads Heartpace's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Heartpace's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Heartpace SOC 2 compliant?
Heartpace is SOC 2 compliant. On SOC2C this listing is Listed.
Is Heartpace ISO 27001 certified?
According to Heartpace's public trust center, Heartpace is ISO 27001 certified. On SOC2C this listing is Listed.
Is Heartpace GDPR compliant?
According to Heartpace's public trust center, Heartpace is GDPR compliant. On SOC2C this listing is Listed.
Can I use Heartpace's SOC 2 for a vendor risk assessment?
Yes. Heartpace's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Heartpace penetration tested?
Yes — Heartpace undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.
Does Heartpace have an ISO 27001 certificate?
Heartpace publishes an ISO certificate on its trust center; you can request access through SOC2C.
Does Heartpace have a penetration test report?
Heartpace publishes a penetration test summary on its trust center. You can request access to it through SOC2C.
Is Heartpace secure?
Security isn't a single yes/no, but Heartpace is SOC 2 compliant and holds ISO 27001, GDPR, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Heartpace have a bug bounty or vulnerability disclosure program?
Heartpace hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@heartpace.com or via a /security page (Heartpace lists a security contact).
Who are Heartpace's subprocessors?
Heartpace lists 4 subprocessors on its trust center, including Amazon Web Services, Intercom, Startdeliver AB, Hetzner. Buyers use this for fourth-party risk review.
Where does Heartpace host or store data?
Heartpace hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Where is Heartpace's trust center or security page?
Heartpace's trust center is at https://trust.heartpace.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where are your servers located?
Our servers are located in Amazon AWS region Stockholm, Sweden, and in region Dublin, Ireland. We also use Hetzner servers in Germany a an extra security layer for our backups.
Do you have an ISO security certificate?
Yes, Heartpace is cerfied under the latest security certification of ISO 27001:2022. The certification body is British Assessment Bureau.
Do you perform external penetration tests?
Yes, we perform penetration tests regularly, provided by an external party.
Is there an SLA for resolving identified security issues?
Yes, Heartpace has a structured SLA. Please refer to our SLA document on the Resourses section in Vanta.
Do you encrypt data at rest?
Yes, we encrypt data at rest, and in transit.
I found a security bug. Do you have an established bug bounty program?
No we do not offer bounty program. However we gladly would receive any information at security@heartpace.com
Is there an SLA for resolving identified security issues?
Of course we have an SLA also covering security issues. Please refer to our SLA document.
Are you DORA compliant?
Yes, DORA is a legislation, and we live up to it via our ISO 27001:2022 certification and also by letting an external party perform an annual internal audit to make sure that we stay compliant.
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public