LEAPWORK

LEAPWORK is SOC 2 Type II compliant. On SOC2C this listing is Listed.

According to LEAPWORK's public trust center, LEAPWORK is ISO 27001 certified. On SOC2C this listing is Listed.

LEAPWORK is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. LEAPWORK's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

LEAPWORK hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Our Trust Center FAQ is a resource designed to address customer concerns about data privacy, security, and compliance. It reflects Leapwork’s commitment to transparency and provides detailed answers about how we handle and protect your data in line with global data protection regulations, including GDPR and CCPA.

Yes, Leapwork is fully compliant with GDPR and CCPA. We process data in accordance with privacy laws, implement Privacy by Design principles, and maintain a Data Processing Addendum (DPA) to outline our obligations as a data processor/service provider. Learn more about GDPR and CCPA compliance in our Privacy Policy (https://www.leapwork.com/privacy-policy).

Leapwork is ISO 27001 certified, reflecting our adherence to stringent information security standards. Additionally, we hold a SOC 2 Type 2 attestation.​​

Leapwork offers two primary products: - Leapwork On-Premises: This solution is installed and managed entirely within the customer’s environment. It provides full control over data storage and processing, making it ideal for customers with strict internal compliance or data residency requirements. Since all data stays within the customer’s infrastructure, compliance with regulations like GDPR depends entirely on the customer’s internal practices. - Leapwork Cloud: This is a cloud-hosted solution leveraging Microsoft Azure infrastructure. While Leapwork ensures the platform’s security and compliance with GDPR, CCPA, and ISO 27001, customers must ensure that their use of the platform aligns with applicable regulations. Features like Cloud Blocks and AI Blocks are managed through secure subprocessors, and Leapwork provides detailed documentation to help customers meet their compliance needs​​​. Both products emphasize privacy and security by design, but the choice depends on whether the customer prefers on-premise control or a scalable cloud-based solution with robust vendor-managed compliance measures.

We employ robust security measures, including: - Encryption: AES-256 encryption for data at rest and TLS 1.2/1.3 for data in transit. - Access Controls: Multi-factor authentication (MFA) and role-based access permissions. - Regular Audits: Security audits and vulnerability testing to proactively address risks​​.