Question 1

Is Modo Labs SOC 2 compliant?

Accepted Answer

Modo Labs is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Modo Labs GDPR compliant?

Accepted Answer

According to Modo Labs's public trust center, Modo Labs is GDPR compliant. On SOC2C this listing is Listed.

Question 3

Is Modo Labs SOC 2 Type I or Type II?

Accepted Answer

Modo Labs is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 4

Can I use Modo Labs's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Modo Labs's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 5

Is Modo Labs penetration tested?

Accepted Answer

Modo Labs hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 6

Is Modo Labs secure?

Accepted Answer

Security isn't a single yes/no, but Modo Labs is SOC 2 Type II compliant and holds SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 7

Does Modo Labs have a bug bounty or vulnerability disclosure program?

Accepted Answer

Modo Labs hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@modolabs.com or via a /security page (Modo Labs lists a security contact).

Question 8

Who are Modo Labs's subprocessors?

Accepted Answer

Modo Labs lists 4 subprocessors on its trust center, including Amazon Web Services, MongoDB, Inc., Pointr, QSS Technosoft Pvt. Ltd.. Buyers use this for fourth-party risk review.

Question 9

Where does Modo Labs host or store data?

Accepted Answer

Modo Labs hosts on AWS, and handles Customer personally identifiable information, Credit card information, Personal health information, (Indoor Maps) Floor plan images and metadata e.g. time zone. Data residency details are on its trust center.

Question 10

Where is Modo Labs's trust center or security page?

Accepted Answer

Modo Labs's trust center is at https://trust.modolabs.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 11

Under new ADA regulations, my apps must fully compliant by April 24, 2026. Is there a roadmap when Modo's "partially" compliant requirements will be “compliant”?

Accepted Answer

Modo is aware of the Title II final rule on web accessibility and the upcoming April 2026/2027 deadlines, and continues to work on improving the product's accessibility. In 2026, Modo will deliver an updated VPAT that reflects the latest accessibility improvements in Modo Campus and its compliance with WCAG 2.2. For customers concerned about the language regarding complete compliance, we will provide details on what changes might be needed in customers' apps in order to achieve full compliance when the updated VPAT is published later this year. Other conformance issues may be the result of underlying flaws within an operating system or screen reader software; we will note those in the VPAT, but may not be able to work around all of those issues. If you have any additional questions about Modo's plans for accessibility and the upcoming Title II deadline, please do not hesitate to contact Modo Support, your Customer Success Manager, or your Account Executive.

Question 12

In which geographies can my app be deployed?

Accepted Answer

Our default region for apps and common services is AWS US West 2 (Oregon). App servers and databases can be deployed to AWS regions in the United States, Australia, Singapore, Ireland, or Canada. Common services only reside in the United States including Modo Communicate.

Question 13

Do you encrypt data at rest? And in transit?

Accepted Answer

Yes. Data at rest on servers is protected by AES-256 encryption on-disk. Data in transit is encrypted using TLSv1.2 with strong cipher suites, and backwards compatibility is turned off by default.

Question 14

Do you support BYOK? Or dedicated encryption keys?

Accepted Answer

Yes, we support both. Either model is compatible with our Premium Hosting that uses dedicated application servers and databases. BYOK requires delegation of your own AWS Key Management Service (KMS) encryption key to us for use with your application. Alternatively, we can create a dedicated encryption key in our AWS KMS. In the case of dedicated keys, we will perform key operations such as rollovers by request on your behalf.

Question 15

Do you support native application certificate pinning?

Accepted Answer

Yes, we support certificate pinning of application launch URLs such as app.example.com. This optional setting requires your iOS and Android apps to validate connections to Modo's trusted application servers, mitigating man-in-the-middle attacks.

Question 16

Do you conduct penetration testing? What is your approach?

Accepted Answer

At least annually, we hire a third-party for penetration testing of assets including the platform and representative mobile apps (iOS and Android). We encourage you to organize your own penetration tests for apps built on Modo's platform. When you share the results, we take the opportunity to triage and validate findings, explain mitigating controls and false positives, and form mutually agreed upon plans. This feedback informs changes that benefit all customers. To schedule your own app's penetration testing, please raise a request with [support@modolabs.com](mailto:support@modolabs.com?subject=Request%20to%20schedule%20pentesting%20for%20my%20app).

Question 17

Can I perform load testing or performance testing on my application?

Accepted Answer

Yes, we support customers performing their own load testing and performance testing. To schedule your own app's testing, please raise a request with [support@modolabs.com](mailto:support@modolabs.com?subject=Request%20to%20schedule%20pentesting%20for%20my%20app).

Question 18

Do you process any personal data?

Accepted Answer

Personal data is not required for Modo's core functionality. Optional features such as Modo Communicate store and process personal data. Modo Communicate powers targeted push notifications or emails to the end users of Modo Campus and Modo Workplace. Communicate recipient directories include a userID and additional attributes (e.g. name, email address) managed by you.

Question 19

Where do you host your services?

Accepted Answer

We use Amazon Web Services (AWS) as our cloud computing, storage and networking provider. Other relevant service providers include MongoDB. We provision our MongoDB Atlas database clusters on AWS.

Question 20

Do your third party service providers have access to customer data?

Accepted Answer

No. Modo does not share customer data with its vendors.

Modo Labs

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai