intigriti

intigriti hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but intigriti is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

intigriti hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@intigriti.com or via a /security page (intigriti lists a security contact).

intigriti lists 6 subprocessors on its trust center, including Amazon Web Services, Google Cloud Platform, MongoDB, Inc., Intigriti LTD, Intigriti EMEA bv. Buyers use this for fourth-party risk review.

intigriti hosts on AWS, GCP. Data residency details are on its trust center.

intigriti's trust center is at https://trust.intigriti.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Strong yes! We run multiple bug bounty programs (public & private) to ensure the cybersecurity posture of our platform and infrastructure. Additionally, we run various tools which execute automated checks on our cloud infrastructure on configuration and behavior with a reference to SOC2, ISO 27001, security recommendations from vendors and the CIS benchmarks. From a compliance perspective, we are recurrently audited as per the ISO 27001 surveillance audit and SOC2 Level 2 requirements. If you have specific concerns, please reach out to us so we can discuss.

We host our infrastructure solely in EU regions. In the application itself your data is processed in a memory safe programming language using strong authorization checks which are security tested upon changes. The data itself is encrypted via AES/256/GCM with a strong cryptographic key specific to that customer which is rotated every 30 days. The customer keys are then encrypted by our own root keys which are rotated every 6 months. Before storing the data at cloud provider, it is encrypted for a second time to ensure full encryption at rest.

Yes! We map our own (S)SDLC to the OWASP SAMM framework to ensure best practices are tracked and applied. For development, we utilize the OWASP ASVS. Any significant change first goes for approval through one of our architectural and scoping meetings to define acceptance criteria. Afterwards, a risk assessment is performed to add security requirements. This is all tracked in a ticket flow, triaged, and tracked accordingly to the correct release schedule. Any development follows a clear framework that alleviates the developers from most security coding concerns. Their Integrated Development Environment (IDE) performs security checks such as static code analysis (SAST). Our pipeline also performs additional checks which will fail the build. If development work is ready, a pull request needs to be opened which is then reviewed by a senior developer before being able to be merged. If the change is implemented, internal security testing is performed according to the WSTG and a final security review is performed. Should the security review find bug tickets opened without risk acceptance, the release is postponed until a decision has been made. After the release, we depend on our public and private bug bounty programs. Any security findings are fed back into our development cycle in the form of process changes, framework modifications, or additional awareness content.

Yes! All employees go through a criminal and background check by a reputable third party during the hiring process. Additionally, we look at the previous experience of the candidate, and perform a rigorous culture and technical interview to ensure the person is a correct fit. Employees also need to sign a mutual non-disclosure that makes them legally liable if they were to leak information or perform misconduct.

Yes! We help you achieve compliance with these regulations in several ways. Firstly, our Vulnerability Disclosure Programs are perfect for third party risk management and monitoring. Our Managed Bug Bounty and Pen-testing-as-a-Service engagements help with resilience testing. Finally, all three products can be used for vulnerability identification and information sharing. For all of these, we generate on-demand reports, attestations, and executive summaries using rich reporting and analytics so organizations can have adequate compliance and risk reporting. We fulfill the appropriate controls under the following standards; ISO 27001:2022 controls: - 5.7 Threat Intelligence - 5.35 Independent Review of Information Security - 8.8 Management of Technical Vulnerabilities ISO 27001:2013 controls: - A.14.2.8: Testing of security functionality shall be carried out during development. (Technical) SOC2 controls: - CC 3.4 Risk management program established - CC 4.1 Control self-assessments conducted - CC 7.2 Vulnerabilities scanned and remediated - CC 7.2 Penetration testing performed - CC 8.1 Vulnerabilities scanned and remediated - CC 8.1 Penetration testing performed NIS2 directives: - Risk Management (art. 21)​ - Incident handling and Reporting (art. 23)​ - Supply Chain Security (art. 18)​ - Vulnerability Disclosure (VDP) (art. 30)​ - Supervision and Enforcement (art. 33)​ - Cybersecurity culture and awareness (art. 18, 21)

Yes! We run multiple bug bounty programs and have ran hybrid pentesting programs for our own platform, in addition to internal penetration testing we execute before a new product release. The public bug bounty program is typically used to audit our researcher side, while the private bug bounty program is limited to renown researchers since we have to manually provision company accounts to provide access.

Yes! We offer Multifactor Authentication (MFA) for researcher and company accounts for free under the form of Time-based One-Time Passwords. (TOTP) This can be setup using any application or password manager of your choice. Company accounts also provide the opportunity to setup Single-Sign On (SSO) to your identity provider of choice such as Azure AD (Office365), Okta, Google Workspace, etc. Since we believe this is a crucial addition to your security posture, we include this for free in every customer plan.