Question 1

Is MergeWorld Ltd SOC 2 compliant?

Accepted Answer

MergeWorld Ltd is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is MergeWorld Ltd HITRUST certified?

Accepted Answer

According to MergeWorld Ltd's public trust center, MergeWorld Ltd is HITRUST certified. On SOC2C this listing is Listed.

Question 3

Is MergeWorld Ltd GDPR compliant?

Accepted Answer

According to MergeWorld Ltd's public trust center, MergeWorld Ltd is GDPR compliant. On SOC2C this listing is Listed.

Question 4

Is MergeWorld Ltd ISO 27001 certified?

Accepted Answer

According to MergeWorld Ltd's public trust center, MergeWorld Ltd is ISO 27001 certified. On SOC2C this listing is Listed.

Question 5

Is MergeWorld Ltd ISO 42001 certified?

Accepted Answer

According to MergeWorld Ltd's public trust center, MergeWorld Ltd is ISO 42001 certified. On SOC2C this listing is Listed.

Question 6

Is MergeWorld Ltd SOC 2 Type I or Type II?

Accepted Answer

MergeWorld Ltd is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 7

Can I use MergeWorld Ltd's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. MergeWorld Ltd's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 8

Is MergeWorld Ltd penetration tested?

Accepted Answer

MergeWorld Ltd hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 9

Can I get MergeWorld Ltd's SOC 2 report?

Accepted Answer

MergeWorld Ltd's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 10

Is MergeWorld Ltd secure?

Accepted Answer

Security isn't a single yes/no, but MergeWorld Ltd is SOC 2 Type II compliant and holds HITRUST, SOC 2 Type II, GDPR, ISO 27001, ISO 42001. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 11

Does MergeWorld Ltd have a bug bounty or vulnerability disclosure program?

Accepted Answer

MergeWorld Ltd hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@mergeworld.com or via a /security page (MergeWorld Ltd lists a security contact).

Question 12

Who are MergeWorld Ltd's subprocessors?

Accepted Answer

MergeWorld Ltd lists 11 subprocessors on its trust center, including Google Cloud Platform, Google Workspace, Google SecOps, Foresite, SentinelOne. Buyers use this for fourth-party risk review.

Question 13

Where does MergeWorld Ltd host or store data?

Accepted Answer

MergeWorld Ltd hosts on GCP. Data residency details are on its trust center.

Question 14

Where is MergeWorld Ltd's trust center or security page?

Accepted Answer

MergeWorld Ltd's trust center is at https://trust.mergeworld.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 15

What is HITRUST?

Accepted Answer

The Health Information Trust Alliance (HITRUST) is an organization governed by representatives from the healthcare industry, but is industry agnostic! It is the agency’s primary security control framework for our primary technology systems.

Question 16

What type of HITRUST certification does MERGE have?

Accepted Answer

MERGE holds a HITRUST Risk-based, 2-year (r2) certification. This certification is valid for a two-year period and involves a comprehensive assessment of MERGE's security practices and implemented infrastructure.

Question 17

How do we measure security with HITRUST?

Accepted Answer

Common Security Framework (CSF) controls are embedded in operations (ex: change management, MDM, third party risk management etc.

Question 18

What is MERGE's HITRUST audit cyle?

Accepted Answer

The current HITRUST r2 certification covers the 2024-2025 period, with an interim assessment scheduled for 2025. Annual review period is from May through July.

Question 19

What is Review Period?

Accepted Answer

(Annually - May, June, and July) InfoSec will work with various teams to perform regular assessments and review of procedures and configurations to ensure HITRUST adherence.

Question 20

What is the MERGE Trust Center?

Accepted Answer

The Trust Center is a dedicated hub where we demonstrate our security commitment and information security culture. It displays our information security growth strategy and allows us to respond to security requests.

Question 21

What can users expect from the Trust Center?

Accepted Answer

Users can expect transparent policies, proactive security updates, and a real-time display of commitment to maintaining a trustworthy and secure environment for all interactions within the agency.

Question 22

What can I do with the Trust Center?

Accepted Answer

After completing the access request, you’ll have a year’s access to transparent security policies and certification documentation. You can also subscribe to security updates! You can now ask MERGE questions for quicker self-service support! Just subscribe to the Trust Center with a business email address.

Question 23

Do you encrypt data at rest?

Accepted Answer

Yes. Tenant data at rest is secured using disk and server-side encryption with managed keys. We use AES-256 encryption for data at rest.

Question 24

How do you monitor for security breaches?

Accepted Answer

We have tools, policies, and procedures in place to identify and mitigate potential security vulnerabilities and threats.

Question 25

What privacy/security settings are available?

Accepted Answer

MERGE is committed to privacy and security, ensuring compliance with legal and industry regulations. We uphold transparent and robust information security policies that encompass identity and access management, configuration management, change management, secure data handling, and security awareness. These policies and procedures are regularly reviewed and validated to maintain the highest standards of protection.

MergeWorld Ltd

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp