Heymarvin

Heymarvin is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Heymarvin's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Yes — Heymarvin undergoes third-party penetration testing as part of its security program. The pentest vendor is listed on its SOC2C profile.

Heymarvin's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Heymarvin publishes a penetration test summary on its trust center. You can request access to it through SOC2C.

Security isn't a single yes/no, but Heymarvin is SOC 2 Type II compliant and holds ISO 42001, ISO 27001, SOC 2 Type II, SOC 2 Type I, GDPR, CCPA, and undergoes third-party penetration testing. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Heymarvin hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@heymarvin.com or via a /security page (Heymarvin lists a security contact).

Heymarvin lists 12 subprocessors on its trust center, including Amazon Web Services, Assembly.AI, Google Workspace, Pendo, New Relic. Buyers use this for fourth-party risk review.

Heymarvin hosts on AWS, Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Data to Train AI models. Data residency details are on its trust center.

Heymarvin's trust center is at https://trust.heymarvin.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes. Our SoC2 report is available for download on this portal.

Yes. Our GDPR compliance report is available on this portal.

Pen testing is done at least once every year on our systems. The pen test report is available to request on this portal.

No, HeyMarvin does not share customer data with OpenAI or any other third-party for training their machine learning models. Even though we utilize third-party models like OpenAI to deliver AI services, we guarantee these entities do not have access to our customer data for refining or training their models. HeyMarvin may use _anonymized data_ for quality assurance or to enhance our own models. _Enterprise customers_ can choose to opt out of this usage. To opt out, please contact your sales representative or email us at [support@heymarvin.com](mailto:support@heymarvin.com).

Most of our security and privacy policies are available on this portal. If you would like to request specific policies, please email us at security@heymarvin.com.

Yes. Enterprise customers can request specific security questionnaire. Please contact your sales person. IF you don't know your sales person please email security@heymarvin.com

Yes. We support all major SSO providers including Google, Microsoft (or Azure) and Okta.

Our Servers are located in various regions of the US and the EU. You can also request to host your data exclusively in either of these regions.

All data is encrypted both at rest and in transit using the current state of the art encryption. You can find our encryption standards and status in SoC2 audit report and on our trust portal.

Please reach out to security@heymarvin.com with the details of the issue.