Is this your company? Buyers are checking Leapsome here. Claim leapsome.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Leapsome
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Leapsome is SOC 2 compliant. Leapsome also holds ISO 27001, GDPR, and CCPA.
About
Welcome to our trust center. At Leapsome, we prioritize the security of your data and ensure the highest standards of safety and compliance. Our Trust Center provides comprehensive information about our security measures, data protection measures, and compliance certifications. Here, you can explore how we safeguard your data, understand our commitment to transparency, and learn about the robust infrastructure that supports our platform. Trust is the cornerstone of our relationship with you, and we are dedicated to maintaining the integrity and confidentiality of your data every step of the wa
Compliance & infrastructure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Compliance leadership
The person who leads Leapsome's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Leapsome's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
4/11 details · 36%SOC2C shows the verified essentials. 7 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Leapsome SOC 2 compliant?
Leapsome is SOC 2 compliant. On SOC2C this listing is Listed.
Is Leapsome ISO 27001 certified?
According to Leapsome's public trust center, Leapsome is ISO 27001 certified. On SOC2C this listing is Listed.
Is Leapsome GDPR compliant?
According to Leapsome's public trust center, Leapsome is GDPR compliant. On SOC2C this listing is Listed.
Is Leapsome CCPA compliant?
According to Leapsome's public trust center, Leapsome is CCPA compliant. On SOC2C this listing is Listed.
Can I use Leapsome's SOC 2 for a vendor risk assessment?
Yes. Leapsome's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Leapsome penetration tested?
Leapsome hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Leapsome secure?
Security isn't a single yes/no, but Leapsome is SOC 2 compliant and holds ISO 27001, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Leapsome have a bug bounty or vulnerability disclosure program?
Leapsome hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@leapsome.com or via a /security page (Leapsome lists a security contact).
Who are Leapsome's subprocessors?
Leapsome's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Leapsome host or store data?
Leapsome's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Leapsome's trust center or security page?
Leapsome's trust center is at https://trust.leapsome.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Where are your servers located?
Frankfurt, Germany (Amazon Web Services).
Do you encrypt data in transit and at-rest?
Yes, we encrypt all data in transit with TLS 1.2 or better and at rest with AES-256 algorithm.
Where can I find your list of Sub-Processors?
All Sub-Processors for the core platform, as well as additional ones tied to customer-enabled functionality, can be found at https://www.leapsome.com/legal/subprocessors
I found a security bug. What can I do?
We run regular external penetration tests/audits with industry-leading security specialists to detect potential vulnerabilities and protect your data. If you still think you have found a security threat in our system, please contact us immediately via [security@leapsome.com](mailto:security@leapsome.com) or +49 160 9798 2209. Your information will remain confidential, and we will deal with your request immediately.
Where can I find Leapsome's Data Processing Agreement?
Leapsome's Data Processing Agreement (DPA) can be found here.
Does Leapsome conduct penetration tests?
Yes, Leapsome conducts penetration tests as part of its incident response plan and vulnerability remediation process at least on annually. Please see our latest PenTest here.
Where can I find information about Leapsome's uptime and downtimes?
Within our SLAs, we aim for an uptime of 99.5% based on 365 days per year, except for planned downtime or events outside our control. Historically, our up-time has been much higher - you can find details here.
Are security event logs collected for all access (employee and customer) to customer information?
Yes, security event logs are collected for all access to customer information, including both employee and customer access.
Are all Leapsome staff backgrounds screened to at least a basic screen level?
Yes, background checks are conducted in accordance with laws and risks for employees with access to Leapsome.
How does Leapsome handle key management and rotation?
Encryption keys are regularly rotated at least yearly for security purposes.
How does Leapsome leverage AI in its product?
Leapsome uses AI in various ways to facilitate the feedback or goal creation process and to coach managers in their daily work. For our commitment to Responsible AI principles please see here.
Is Leapsome SOC II certified?
No, we are not, but ISO 27001 and SOC II are practically considered valid alternatives to one another. Both frameworks are recognized globally, but SOC II is more closely associated with North America. If you’re based in North America, you’ll find that both SOC II and ISO 27001 are common. Outside of North America, ISO 27001 is much more popular.
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public