Is this your company? Buyers are checking Holistiplan here. Claim holistiplan.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Holistiplan
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Holistiplan is SOC 2 Type II compliant. Holistiplan also holds CCPA.
About
Holistiplan is an award-winning software for financial planners and investment advisors built to systematize and automate the process of reviewing a client’s financial documents to find potential planning opportunities. Holistiplan uses optical character recognition (OCR) to read uploaded documents and generate client-ready reports that uncover potential financial planning opportunities through an algorithmic program. Financial professionals can then run various scenarios to determine future outcomes.
Compliance & infrastructure
SOC 2 Type IICCPA
Hosting
AWS
Data handled
Customer personally identifiable information
Documents
15Documents
- SOC 2 Type II ReportRequest
- Soc 2 Bridge LetterRequest
- CCPA Compliance ReportRequest
- Incident Response PlanRequest
- Business Continuity / Disaster Recovery PlanRequest
- 2025 Holistiplan Penetration Test Final - RedactedRequest
- 2025 Penetration Test Remediation PlanRequest
- Information Security ProgramRequest
- Holistiplan COI - 9.1.25Request
- AI Assurance StatementRequest
- AWS SOC 2 ReportRequest
- AWS ISO 27001Request
- AWS ISO/IEC 42001Request
- Security Highlights 2026Request
- Holistiplan W-9Request
Subprocessors
1- AAmazon Web Services · Cloud HostingU.S. East-1, Virginia
Compliance leadership
The person who leads Holistiplan's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Holistiplan's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Holistiplan SOC 2 compliant?
Holistiplan is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Holistiplan CCPA compliant?
According to Holistiplan's public trust center, Holistiplan is CCPA compliant. On SOC2C this listing is Listed.
Is Holistiplan SOC 2 Type I or Type II?
Holistiplan is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Holistiplan's SOC 2 for a vendor risk assessment?
Yes. Holistiplan's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Holistiplan penetration tested?
Holistiplan hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Holistiplan's SOC 2 report?
Holistiplan's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Does Holistiplan have an ISO 27001 certificate?
Holistiplan publishes an ISO certificate on its trust center; you can request access through SOC2C.
Is Holistiplan secure?
Security isn't a single yes/no, but Holistiplan is SOC 2 Type II compliant and holds SOC 2 Type II, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Holistiplan have a bug bounty or vulnerability disclosure program?
Holistiplan hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@holistiplan.com or via a /security page (Holistiplan lists a security contact).
Who are Holistiplan's subprocessors?
Holistiplan lists 1 subprocessor on its trust center, including Amazon Web Services. Buyers use this for fourth-party risk review.
Where does Holistiplan host or store data?
Holistiplan hosts on AWS, and handles Customer personally identifiable information. Data residency details are on its trust center.
Where is Holistiplan's trust center or security page?
Holistiplan's trust center is at https://trust.holistiplan.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Does Holistiplan provide cloud service(s)?
Yes, Holistiplan’s tax software is completely cloud-based. Our solution is offered as a SaaS tool and leverages industry-leading technology through our partnership with Amazon Web Services (AWS). While our service is multi-tenant, AWS leverages tenant isolation so that our data is kept entirely separate and is not accessible to anyone outside of the Holistiplan organization.
Does Holistiplan encrypt our data?
Yes, Holistiplan encrypts all data within our application both at rest and in transit. We leverage industry-leading 256 bit encryption.
Does Holistiplan have a dedicated person or group responsible for privacy compliance?
Yes, Holistiplan’s CTO works in conjunction with the CISO to maintain our compliance and security standards as they relate to data privacy.
Does Holistiplan have an internal compliance and/or ethics program?
Yes. Holistiplan’s Security Program is informed by SOC 2 Type II and NIST frameworks, and is continuously monitored for control effectiveness using a number of technical tools and processes. Conduct and ethics are covered within this security and compliance program.
Does Holistiplan maintain policies and procedures to enable compliance with legal, regulatory, statutory, or contractual obligations regarding information security requirements?
Yes, Holistiplan has extensive documented policies and procedures in place that are designed to support SOC 2 Type II compliance. Holistiplan monitors for compliance and undergoes annual SOC 2 audits.
Who or what department is responsible for maintaining and reviewing this program?
The Holistiplan executive management, including the CTO, CISO and co-founders are responsible for maintaining and reviewing the Change Management Program.
Does Holistiplan have a documented response program to address privacy incidents, unauthorized disclosure, unauthorized access, or breach of client data?
Yes, Holistiplan has incorporated its annually tested formalized incident response plan in its information security program.
Does Holistiplan store any data outside of the United States?
No. Including any backup copies, all data remain in data centers within the United States.
Does Holistiplan require your staff to be trained and tested on information security protection and cybersecurity policies and procedures?
Yes, all employees are required to complete a security awareness training at time of hire, as well as on an annual basis thereafter. This training includes topics such as threats to be aware of, strategies for remaining safe, phishing, and clean desk policy.
Does Holistiplan share our data with third party vendors?
No, we do not share your firm’s or your client’s data with any outside entities. Per our privacy policies, we would only share information if compelled to do so by law enforcement.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public