Question 1

Is Maze SOC 2 compliant?

Accepted Answer

Maze is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Maze GDPR compliant?

Accepted Answer

According to Maze's public trust center, Maze is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Maze SOC 2 Type I or Type II?

Accepted Answer

Maze is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Maze's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Maze's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Maze penetration tested?

Accepted Answer

Maze hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 6

Is Maze secure?

Accepted Answer

Security isn't a single yes/no, but Maze is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 7

Does Maze have a bug bounty or vulnerability disclosure program?

Accepted Answer

Maze hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@maze.co or via a /security page (Maze lists a security contact).

Question 8

Who are Maze's subprocessors?

Accepted Answer

Maze lists 33 subprocessors on its trust center, including Amazon Web Services (AWS), AuraDB (Neo4j Inc.), Google Cloud Platform, OpenAI, Amplitude. Buyers use this for fourth-party risk review.

Question 9

Where does Maze host or store data?

Accepted Answer

Maze hosts on AWS, GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 10

Where is Maze's trust center or security page?

Accepted Answer

Maze's trust center is at https://compliance.maze.co. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 11

Is Maze SOC 2 certified?

Accepted Answer

Yes, Maze is SOC 2 Type II certified. You can access the report from the Resources tab in this Trust Center. Our SOC 2 report is issued annually and reflects the assessment period leading up to issuance. If you need coverage from the audit period end date to today, we can provide a bridge letter confirming no material changes and continued adherence to our security and compliance controls. Please contact your Maze point of contact to request it.

Question 12

How long is the current SOC2 Type II report valid for?

Accepted Answer

Our current SOC2 report is valid for 12 months from date of issue. Maze is committed to maintaining our SOC2 certification, and will continue to renew annually. Maze will ensure the renewed SOC2 report is made available in due time to ensure valid continuity.

Question 13

Does Maze comply with GDPR?

Accepted Answer

Yes. Maze complies with GDPR. To request deletion of personal data, email help@maze.co.

Question 14

Does Maze have a pre-filled security questionnaire?

Accepted Answer

Yes. Please find our pre-filled CAIQ questionnaire under the Resources tab. Feel free to review and/or share with your team responsible for due diligence / vendor vetting.

Question 15

Where are Maze's servers located?

Accepted Answer

Maze’s platform and infrastructure are hosted in the United States, within the AWS US-East region. For more information regarding data processing, please see Maze's Data Processing Addendum. Please also see Maze's Privacy Policy for more details regarding our privacy.

Question 16

Does Maze collect personally identifiable information (PII)?

Accepted Answer

Yes. As part of our operations, Maze collects limited personal information (e.g., name and email) to create and manage Maze accounts and operate our services. For more information, please see our Privacy Policy.

Question 17

Where can I read more about how you use AI in your product offering?

Accepted Answer

Please see https://help.maze.co/hc/en-us/articles/31119382384531-AI-FAQs for more details.

Question 18

Does Maze encrypt data?

Accepted Answer

Yes. Maze encrypts data at rest and in transit. - At rest: All data, including backups, is encrypted using AES-256. - In transit: Data is encrypted using TLS 1.2+ between clients and our services. We enforce HSTS, and certificates are issued and managed through AWS. - Key management: Encryption keys are stored and managed by AWS Key Management Service (KMS), which uses hardware security modules validated under FIPS 140-2.

Question 19

Does Maze support Single Sign-On (SSO)?

Accepted Answer

Yes. Maze supports SAML and OpenID Connect via the WorkOS SSO API for Enterprise plans. See our Help Center for details.

Question 20

I found a security bug. Does Maze have an established bug bounty program?

Accepted Answer

Maze does not currently have a bug bounty program, however please see our Responsible Security Disclosure for more details on how we prefer to handle responsible disclosure of potential vulnerabilities that may have been found.

Question 21

Where can I find Maze's status page?

Accepted Answer

Please see Maze Status for more details. Maze encourages customers to subscribe to this status page for real-time notifications when we experience performance issues.

Maze

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp