Knoetic Inc

Knoetic Inc hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@knoetic.com or via a /security page (Knoetic Inc lists a security contact).

Knoetic Inc lists 12 subprocessors on its trust center, including Amazon Web Services, Dagster, Snowflake, Anthropic, Cursor. Buyers use this for fourth-party risk review.

Knoetic Inc hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Knoetic Inc's trust center is at https://trust.knoetic.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Internal access to all Knoetic data and applications is protected by an employee authentication system with role-based permissions. This access is restricted to full-time engineers and support staff. Access is granted using the principle of least privilege. If a Knoetic employee is terminated, they lose access to all internal tools, and their application credentials are revoked. They do not have further access to any internal data, including client data. In addition, we have remote wipe capability for employee devices, and have software installed on all employee machines to enforce best practices such as secure passwords.

Knoetic customer data is stored on scalable cloud servers provided by Amazon Web Services. Data is stored in data centers located exclusively in the United States, and accessed solely by US employees. All client data is stored encrypted with 256-bit Advanced Encryption Standard (AES-256). Our data backups are similarly encrypted. All of Knoetic’s products and services are only accessible over a secure HTTPS connection. Knoetic servers use HTTPS with TLS 1.2 for all communications. This includes 128 bit TDES/3DES or equivalent cryptographic algorithms. (All SSLv3 protocols have been disabled.)

Cryptographic keys are generated using a SHA-256 cryptographic hash function, and managed and stored within isolated cryptographic modules. The key manager (Head of Engineering) is responsible for managing the generation, storage, rotation, export, and retirement of cryptographic keys. Keys are rotated periodically.

Passwords are never stored in or communicated via plaintext - we use a one-way cryptographic hash function called BCrypt, an industry standard for password hashing. And we salt our BCrypt hashes for maximal security (using PBKDF2 and SHA-256, 24000 iterations).

Knoetic typically connects with HR systems via their external APIs with requests for data about each employee. These data points can broadly be grouped into the following categories (you can see a full list of all data fields in our downloads section): ● Employee general information: Name, age, gender, ethnicity, contact information, etc. ● Compensation: Pay amount, rate, frequency, associated dates, etc. ● Employment: Job title, manager, position, tenure, associated dates, etc. ● Recruiting: Applications, candidates, requisitings, recruiters, interviews ● Performance: Rating, comment, description This data is extracted from the underlying systems approximately 4-6 times a day and is stored in our S3 environment. From there our ETL process transforms and loads this data into Knoetic where it is live for you to view on Knoetic.

Yes - we support any provider supporting SAML. This includes but is not limited to: Okta, Auth0, Duo and OneLogin.

Knoetic integrates with Google Calendar to support specific user-facing features within the platform. When a user connects their Google Calendar, Knoetic accesses calendar data in read-only mode to display meeting information within the product. This includes event titles, start and end times, and attendee email addresses. Knoetic does not create, modify, or delete calendar events. Knoetic also uses third-party AI providers, including OpenAI, Anthropic (Claude), and Google Gemini, to power certain features within the platform. These AI services are used only for user-initiated workflows. Google Calendar data is not shared with or processed by any AI systems. Calendar data is used only for calendar-related functionality. AI systems operate on separate data pipelines and do not access Google user data. Knoetic does not use Google user data for AI model training, advertising, or any secondary purposes. Data is used only to support features explicitly initiated by the user and is handled in accordance with enterprise-grade security standards, including SOC 2 Type II controls. The use of raw or derived user data received from Google Workspace APIs will adhere to the Google User Data Policy, including the Limited Use requirements.