Is this your company? Buyers are checking IcePanel here. Claim icepanel.io free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
IcePanel
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
IcePanel is SOC 2 Type II compliant. IcePanel also holds ISO 27001, and GDPR.
About
🧊 IcePanel is a collaborative diagramming tool that helps software engineering and product teams align on technical decisions. Learn more at: [icepanel.io](http://u.icepanel.io/b5dd945c)
Compliance & infrastructure
Hosting
GCP
Data handled
Employee personally identifiable information
Documents
1Subprocessors
15- DDatadog · Security thread detectionUnited States
- DDocuSign · Invoices, legal contractsUnited States
- GGoogle Cloud Platform · App functionality, customer support, user analytics, data storage, backup storagUnited States
- GGoogle Workspace · Invoices, receipts, customer support, legal contracts, user analyticsUnited States
- LLinear · Customer feedback and supportUnited States
- MMissive · Customer supportUnited States
- MMixpanel · User analytics, customer supportUnited States
- NNotion · Customer feedback, pilot trackingUnited States
- RResend · Transactional and marketing communicationUnited States
- SSentry · Error tracking, customer supportUnited States
- SSlack · Customer support, user analyticsUnited States
- SStripe · Payment processing, subscription management, invoices, receipts, financial reporUnited States
Show all 15 subprocessorsShow fewer
- XXero · Invoices, receipts, financial reportingUnited States
- AAttio · Customer relationship managementUnited Kingdom
- OOpenAI · EngineeringUnited States
Compliance leadership
The person who leads IcePanel's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. IcePanel's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Data Processing AgreementDec 2025
- Adding Turbopuffer as a sub-processor
Updated Penetration Testing Reports are now availableDec 2025
Our 2025/2026 pen tests reports are now available for viewing/downloading.
Data Processing AgreementOct 2025
- Adding Attio as a sub-processor - Adding OpenAI as a sub-processor
Data Processing AgreementSep 2025
- Removing Posthog as a sub-processor - Adding Customer.io as a sub-processor
Insurance Policy UpdatedAug 2025
- Insurance policy currency changed from CAD to USD - Professional liability and cyber coverage increased to 10 million
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is IcePanel SOC 2 compliant?
IcePanel is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is IcePanel ISO 27001 certified?
According to IcePanel's public trust center, IcePanel is ISO 27001 certified. On SOC2C this listing is Listed.
Is IcePanel GDPR compliant?
According to IcePanel's public trust center, IcePanel is GDPR compliant. On SOC2C this listing is Listed.
Is IcePanel SOC 2 Type I or Type II?
IcePanel is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use IcePanel's SOC 2 for a vendor risk assessment?
Yes. IcePanel's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is IcePanel penetration tested?
IcePanel hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is IcePanel secure?
Security isn't a single yes/no, but IcePanel is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does IcePanel have a bug bounty or vulnerability disclosure program?
IcePanel hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@icepanel.io or via a /security page (IcePanel lists a security contact).
Who are IcePanel's subprocessors?
IcePanel lists 15 subprocessors on its trust center, including Datadog, DocuSign, Google Cloud Platform, Google Workspace, Linear. Buyers use this for fourth-party risk review.
Where does IcePanel host or store data?
IcePanel hosts on GCP, and handles Employee personally identifiable information. Data residency details are on its trust center.
Where is IcePanel's trust center or security page?
IcePanel's trust center is at https://trust.icepanel.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Do you support Single Sign-On (SSO)?
Yes we support single sign using SAML 2.0 on the growth plan or above.
Where are your servers located?
We host our database in the following locations: - Oregon, US We host our API in the following locations: - Oregon, US - Virginia, US - London, UK
Do you encrypt data?
We encrypt data at rest, in transit and at storage.
Do you perform backups?
Our platform performs automatic backups. - We backup our production database and user authentication data every 4 hours. - Backups are stored in a multi-region bucket in the US and are retained for 1 year. - Our end to end backup restoration procedure is tested annually.
Are you GDPR compliant if you store data in the US?
Our legal team have prepared a Data Processing Agreement (DPA) which includes details about how we process data, and can be found on the resources tab. This includes the Standard Contractual Clauses (SCCs) provided by the EU to allow international data transfer while remaining GDPR compliant. Please contact us to set up our DPA for legal signature.
Do you have an established bug bounty program?
We don't offer security bug bounties at this time.
Do you support SCIM?
We don't currently support automated user provisioning/de-provisioning/SCIM, however it is on our roadmap.
Is there a way to export all our data?
Yes, you can export all your model objects/connections in JSON or CSV format. We also have a REST API to automate this.
What is the SLA you provide for the product?
We can guarantee 99.5% uptime from Google Cloud services and have a 48-hour SLA for support messages during business hours PST.
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public