Question 1

Is Mergify SOC 2 compliant?

Accepted Answer

Mergify is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Mergify GDPR compliant?

Accepted Answer

According to Mergify's public trust center, Mergify is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Mergify SOC 2 Type I or Type II?

Accepted Answer

Mergify is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Mergify's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Mergify's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Mergify penetration tested?

Accepted Answer

Mergify hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 6

Can I get Mergify's SOC 2 report?

Accepted Answer

Mergify's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 7

Does Mergify offer a Data Processing Agreement (DPA)?

Accepted Answer

Mergify publishes a DPA on its trust center; you can request access through SOC2C.

Question 8

Is Mergify secure?

Accepted Answer

Security isn't a single yes/no, but Mergify is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does Mergify have a bug bounty or vulnerability disclosure program?

Accepted Answer

Mergify hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@mergify.com or via a /security page (Mergify lists a security contact).

Question 10

Who are Mergify's subprocessors?

Accepted Answer

Mergify lists 6 subprocessors on its trust center, including Cloudflare, Stripe, Datadog, Google Cloud Platform, Plain. Buyers use this for fourth-party risk review.

Question 11

Where does Mergify host or store data?

Accepted Answer

Mergify hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Question 12

Does Mergify offer a Data Processing Agreement (DPA)?

Accepted Answer

Mergify publishes a DPA on its trust center. You can request access through SOC2C.

Question 13

Where is Mergify's trust center or security page?

Accepted Answer

Mergify's trust center is at https://trust.mergify.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 14

I found a security bug. Do you have an established bug bounty program?

Accepted Answer

Mergify hosts its public Bug Bounty program with HackerOne. If you’re an independent security expert or researcher and believe you’ve discovered a security-related issue on our platform, we appreciate you disclosing the issue to us responsibly, and thank you for your time and expertise.

Mergify

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai