Multiverse Group

Multiverse Group's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Security isn't a single yes/no, but Multiverse Group is SOC 2 compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Multiverse Group hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@multiverse.io or via a /security page (Multiverse Group lists a security contact).

Multiverse Group lists 35 subprocessors on its trust center, including Amazon Web Services, Google Workspace, Slack, Freshworks, 1Password. Buyers use this for fourth-party risk review.

Multiverse Group hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Multiverse Group's trust center is at https://trust.multiverse.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Yes, Multiverse encrypts data at rest. The company's datastores housing sensitive customer data are encrypted using strong encryption methods, such as AES 256, to ensure the confidentiality and security of the data. This is part of the comprehensive approach to data security, which aligns with our compliance with ISO 27001:2022 and other security standards.

Multiverse's servers are located in the following regions: 1. United Kingdom: Our main web platform and client databases are hosted on Amazon Web Services (AWS) in London. 2. European Union: We use Google Workspace for email and file storage, which is located within the EU (specifically in Dublin, Ireland). This server architecture ensures that your data is held within the UK and EU, complying with data protection regulations such as GDPR. For more detailed information about our data storage practices and locations, please refer to our privacy policy https://www.multiverse.io/en-GB/our-policies/privacy-policy.

Multiverse handles the data we collect with utmost care and in compliance with data protection regulations. Here's an overview of our data handling practices: 1. Data Collection: We collect various types of personal data, including: - Candidate information: name, email, phone number, address, work experience, qualifications, and interview-related data. - Apprentice information: additional data collected during the apprenticeship cycle. 2. Data Storage: - Our web platform and client databases are hosted on AWS in London. - We use Google Workspace for email and file storage within the EU. - All data is stored within these cloud services. 3. Data Protection: - Encryption in Transit: We use strong encryption (TLS v. 1.2+) for data in transit. - Encryption at Rest: Data at rest is encrypted using AES 256 encryption. - Access Control: We implement strict access controls based on the principle of least privilege. 4. Data Backup: - Regular backups are conducted and stored securely. - Backups are encrypted and stored separately from the primary data store. 5. Data Processing: - We process personal data, including sensitive data as defined by GDPR (such as racial or ethnic origin and health data). - Data processing complies with GDPR and other relevant data protection laws. 6. Compliance and Security Measures: - We adhere to GDPR and other data protection regulations. - Regular security assessments, including penetration testing and vulnerability scans, are conducted.

Multiverse conducts penetration testing as part of the comprehensive approach to data security. Annual penetration tests on customer facing infrastructure is performed, to assess security posture and identify potential vulnerabilities. This is complemented by continuous scanning of the infrastructure to proactively detect and remediate any weaknesses, aligning with industry best practices.

Here's a bullet-point list of the key security measures in place at Multiverse: 1. Access Control and Authentication: - Multi-Factor Authentication (MFA) for remote access and internet-accessible systems - Role-Based Access Control (RBAC) - Principle of least privilege for system access - Regular access reviews and recertification (quarterly) - Strong password policies enforced 2. Encryption and Data Protection: - Data encrypted in transit using TLS 1.2+ - Data encrypted at rest using AES 256 - Secure key management practices 3. Network Security: - Zero Trust network architecture - Web Application Firewalls (WAF) for customer facing platforms - Secure DNS and browser content checking/blocking 4. Monitoring and Threat Detection: - Outsourced SOC and SIEM for real-time scanning and monitoring of applications and infrastructure - Continuous vulnerability scanning and penetration testing - Logging and monitoring of user activities, especially privileged access 5. Incident Response and Business Continuity: - Comprehensive Cyber Incident Response Plan - Formal Business Continuity Plan - Disaster Recovery Plan 6. Secure Development Practices: - Secure Software Development Lifecycle (SDLC) - Regular code reviews and static analysis - Automatic dependency updates (where possible) 7. Third-Party Risk Management: - Vendor due diligence and security assessments - Contractual security requirements for third-party service providers 8. Physical Security: - Access controls, manned reception, and CCTV in office locations - Secure disposal of confidential waste 9. Employee Security: - Regular security awareness training for all employees - Background checks for new employees 10. Compliance and Certifications: - ISO 27001:2022 certified - Cyber Essentials and Cyber Essentials Plus certified 11. Data Privacy: - Comprehensive data protection program - Dedicated Data Protection Officer - Regular Data Protection Impact Assessments (DPIAs) 12. Cloud Security: - Use of secure cloud…

Multiverse employs a comprehensive and proactive approach to risk management across its operations. Here are the key components of Multiverse's risk management strategy: 1. Risk Register: Multiverse maintains a dedicated risk register, particularly focused on Information Security risks. This register serves as a central repository for identified risks and their potential impacts. 2. Regular Risk Assessments: The company conducts regular impact assessments and security reviews to identify risks in both current and changing business activities. These assessments help in early risk detection and mitigation. 3. Proactive Risk Identification and Remediation Multiverse actively uses information from risk assessments to identify and address risks in current or changed business activities. This proactive approach ensures that potential issues are dealt with before they can impact operations. 4. Regular Risk Management Meetings: Multiverse holds regular meetings to address risks identified in the risk register, ensuring ongoing attention to risk management at all levels of the business.

The AI functionality is a core component of our services and cannot be disabled. This integration allows us to personalise learning, identify skill gaps effectively, and enhance apprentice engagement for superior outcomes. We utilise the secure Microsoft Azure Proxy Layer for our AI models and have responsible principles in place.

Multiverse is primarily based in the United Kingdom and the United States. Here are the key details about our business locations: 1. United Kingdom: Our company is registered in England, with our registered address at 2 Eastbourne Terrace, Floors 5+6, London, W2 6LG. The UK serves as our primary base of operations. 2. United States: We have a significant presence in the US, which is one of our main operational hubs alongside the UK.

1. Contact Multiverse's Privacy team immediately. The best way to do this is by sending an email to privacy@multiverse.io. 2. In your report, provide as much detail as possible about the potential security issue you've observed or suspect. This could include: - The nature of the issue - When you noticed it - Any potential impact you've observed - Any other relevant information Multiverse takes all potential issues seriously and appreciates your vigilance in reporting them. The teams will investigate the report promptly and take appropriate action as needed.

Yes, Multiverse undertakes comprehensive security awareness training for its employees. Here are the key points about Multiverse's security awareness training program: 1. Mandatory Participation: All employees are required to undergo security awareness training. 2. Training Content: The training covers various aspects of security, including: - Cyber Security Awareness - GDPR (General Data Protection Regulation) 4. Delivery Methods: Training is delivered through multiple channels: - Online training modules - In-person presentations - Web-based training videos 5. Regular Updates: The training content is updated annually to ensure it remains relevant and addresses current security threats and best practices. 6. Targeted Approach: The training is designed to address identified skills gaps and positively impact workforce members' security behaviour.