intigriti

intigriti is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to intigriti's public trust center, intigriti is ISO 27001 certified. On SOC2C this listing is Listed.

According to intigriti's public trust center, intigriti is GDPR compliant. On SOC2C this listing is Listed.

intigriti is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. intigriti's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Strong yes! We run multiple bug bounty programs (public & private) to ensure the cybersecurity posture of our platform and infrastructure. Additionally, we run various tools which execute automated checks on our cloud infrastructure on configuration and behavior with a reference to SOC2, ISO 27001, security recommendations from vendors and the CIS benchmarks. From a compliance perspective, we are recurrently audited as per the ISO 27001 surveillance audit and SOC2 Level 2 requirements. If you have specific concerns, please reach out to us so we can discuss.

We host our infrastructure solely in EU regions. In the application itself your data is processed in a memory safe programming language using strong authorization checks which are security tested upon changes. The data itself is encrypted via AES/256/GCM with a strong cryptographic key specific to that customer which is rotated every 30 days. The customer keys are then encrypted by our own root keys which are rotated every 6 months. Before storing the data at cloud provider, it is encrypted for a second time to ensure full encryption at rest.

Yes! We map our own (S)SDLC to the OWASP SAMM framework to ensure best practices are tracked and applied. For development, we utilize the OWASP ASVS. Any significant change first goes for approval through one of our architectural and scoping meetings to define acceptance criteria. Afterwards, a risk assessment is performed to add security requirements. This is all tracked in a ticket flow, triaged, and tracked accordingly to the correct release schedule. Any development follows a clear framework that alleviates the developers from most security coding concerns. Their Integrated Development Environment (IDE) performs security checks such as static code analysis (SAST). Our pipeline also performs additional checks which will fail the build. If development work is ready, a pull request needs to be opened which is then reviewed by a senior developer before being able to be merged. If the change is implemented, internal security testing is performed according to the WSTG and a final security review is performed. Should the security review find bug tickets opened without risk acceptance, the release is postponed until a decision has been made. After the release, we depend on our public and private bug bounty programs. Any security findings are fed back into our development cycle in the form of process changes, framework modifications, or additional awareness content.

Yes! All employees go through a criminal and background check by a reputable third party during the hiring process. Additionally, we look at the previous experience of the candidate, and perform a rigorous culture and technical interview to ensure the person is a correct fit. Employees also need to sign a mutual non-disclosure that makes them legally liable if they were to leak information or perform misconduct.

Yes! We help you achieve compliance with these regulations in several ways. Firstly, our Vulnerability Disclosure Programs are perfect for third party risk management and monitoring. Our Managed Bug Bounty and Pen-testing-as-a-Service engagements help with resilience testing. Finally, all three products can be used for vulnerability identification and information sharing. For all of these, we generate on-demand reports, attestations, and executive summaries using rich reporting and analytics so organizations can have adequate compliance and risk reporting. We fulfill the appropriate controls under the following standards; ISO 27001:2022 controls: - 5.7 Threat Intelligence - 5.35 Independent Review of Information Security - 8.8 Management of Technical Vulnerabilities ISO 27001:2013 controls: - A.14.2.8: Testing of security functionality shall be carried out during development. (Technical) SOC2 controls: - CC 3.4 Risk management program established - CC 4.1 Control self-assessments conducted - CC 7.2 Vulnerabilities scanned and remediated - CC 7.2 Penetration testing performed - CC 8.1 Vulnerabilities scanned and remediated - CC 8.1 Penetration testing performed NIS2 directives: - Risk Management (art. 21)​ - Incident handling and Reporting (art. 23)​ - Supply Chain Security (art. 18)​ - Vulnerability Disclosure (VDP) (art. 30)​ - Supervision and Enforcement (art. 33)​ - Cybersecurity culture and awareness (art. 18, 21)