Question 1

Is Loyal SOC 2 compliant?

Accepted Answer

Loyal is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Loyal HIPAA compliant?

Accepted Answer

According to Loyal's public trust center, Loyal is HIPAA compliant. On SOC2C this listing is Listed.

Question 3

Is Loyal SOC 2 Type I or Type II?

Accepted Answer

Loyal is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Loyal's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Loyal's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Loyal penetration tested?

Accepted Answer

Loyal hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 6

Can I get Loyal's SOC 2 report?

Accepted Answer

Loyal's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 7

Is Loyal secure?

Accepted Answer

Security isn't a single yes/no, but Loyal is SOC 2 Type II compliant and holds SOC 2 Type II, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Loyal have a bug bounty or vulnerability disclosure program?

Accepted Answer

Loyal hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@loyalhealth.com or via a /security page (Loyal lists a security contact).

Question 9

Who are Loyal's subprocessors?

Accepted Answer

Loyal lists 5 subprocessors on its trust center, including Microsoft Azure, Mailgun, Mixpanel, Twilio, ActiveCampaign. Buyers use this for fourth-party risk review.

Question 10

Where does Loyal host or store data?

Accepted Answer

Loyal hosts on Azure, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 11

Where is Loyal's trust center or security page?

Accepted Answer

Loyal's trust center is at https://trust.loyalhealth.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Loyal

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp