Question 1

Is Horizon3.ai SOC 2 compliant?

Accepted Answer

Horizon3.ai is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Horizon3.ai GDPR compliant?

Accepted Answer

According to Horizon3.ai's public trust center, Horizon3.ai is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Horizon3.ai CMMC compliant?

Accepted Answer

According to Horizon3.ai's public trust center, Horizon3.ai is CMMC compliant. On SOC2C this listing is Listed.

Question 4

Is Horizon3.ai SOC 2 Type I or Type II?

Accepted Answer

Horizon3.ai is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 5

Can I use Horizon3.ai's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Horizon3.ai's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 6

Is Horizon3.ai penetration tested?

Accepted Answer

Horizon3.ai hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 7

Is Horizon3.ai secure?

Accepted Answer

Security isn't a single yes/no, but Horizon3.ai is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR, CMMC. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Horizon3.ai have a bug bounty or vulnerability disclosure program?

Accepted Answer

Horizon3.ai hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@horizon3.ai or via a /security page (Horizon3.ai lists a security contact).

Question 9

Who are Horizon3.ai's subprocessors?

Accepted Answer

Horizon3.ai lists 12 subprocessors on its trust center, including Amazon Web Services, Salesforce, Google Workspace, ZenDesk, Datadog. Buyers use this for fourth-party risk review.

Question 10

Where does Horizon3.ai host or store data?

Accepted Answer

Horizon3.ai hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 11

Where is Horizon3.ai's trust center or security page?

Accepted Answer

Horizon3.ai's trust center is at https://trust.horizon3.ai. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

Hows does Horizon3.ai store PII data with regards to GDPR Data Privacy?

Accepted Answer

- User data of a NodeZero user, not users discovered during pentesting operations as pentesting data is stored within the NodeZero EU instance, may be stored in the US. For example, when a user opens a support ticket during US business hours. This data gets stored in our Customer Support Solution within the US. This includes information required to facilitate the support ticket, such as names and contact details.

Question 13

Does anyone from the US Horizon3.ai team access data that is within NodeZero EU?

Accepted Answer

One of our US Engineers might potentially access diagnostic data of the underlying EU cloud infrastructure or assist with support requests to check if the cloud/pentest is running properly.

Question 14

I see policies referencing "FY" for fiscal year. When is your fiscal year?

Accepted Answer

Horizon3.ai's fiscal year begins on February 1st and ends on January 31st.

Question 15

How does your product work and is it safe to run in production?

Accepted Answer

Horizon3.ai’s autonomous penetration testing as-a-service (APTaaS) solution, NodeZero, is an on-demand, self-service pentesting platform that is safe to run in production and requires no persistent or credentialed agents. NodeZero filters the noise and identifies the critical impacts that must be fixed now, so you don’t waste valuable time and resources chasing down vulnerabilities that don’t pose a threat to the business. NodeZero’s detailed path diagrams show you how vulnerabilities, harvested credentials, misconfigurations and dangerous product defaults can be chained together into attack vectors that lead to critical impacts, giving you an expert view into exactly how an attacker can compromise your system. Proof-of-exploit panels show you what to fix, while our fix action procedures provide you with detailed guidance. It’s not just a compliance checkbox; this is effective security to keep your company out of the headlines.

Question 16

Do you use MFA for access to Horizon3.ai systems?

Accepted Answer

Yes, Horizon3.ai has implemented phishing resistant MFA solution(s) for access by all employees, executives, and contractors to Horizon3.ai systems.

Question 17

Does Horizon3.ai encrypt data?

Accepted Answer

Yes, Horizon3.ai implements encryption with industry standard and best practices encryption methods and algorithms for data at rest and in transit such as AES 256 and TLS.

Question 18

Do you support Single Sign-On (SSO)?

Accepted Answer

Yes - The NodeZero Portal supports OpenID Connect (OIDC) compatible identity providers (IdP). This includes but is not limited to: Okta, Keycloak, Ping, Google, and Azure AD.

Horizon3.ai

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai