Multiverse Group

Multiverse Group is SOC 2 compliant. On SOC2C this listing is Listed.

According to Multiverse Group's public trust center, Multiverse Group is ISO 27001 certified. On SOC2C this listing is Listed.

Yes. Multiverse Group's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Multiverse Group hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Multiverse Group publishes an ISO certificate on its trust center; you can request access through SOC2C.

Yes, Multiverse encrypts data at rest. The company's datastores housing sensitive customer data are encrypted using strong encryption methods, such as AES 256, to ensure the confidentiality and security of the data. This is part of the comprehensive approach to data security, which aligns with our compliance with ISO 27001:2022 and other security standards.

Multiverse's servers are located in the following regions: 1. United Kingdom: Our main web platform and client databases are hosted on Amazon Web Services (AWS) in London. 2. European Union: We use Google Workspace for email and file storage, which is located within the EU (specifically in Dublin, Ireland). This server architecture ensures that your data is held within the UK and EU, complying with data protection regulations such as GDPR. For more detailed information about our data storage practices and locations, please refer to our privacy policy https://www.multiverse.io/en-GB/our-policies/privacy-policy.

Multiverse handles the data we collect with utmost care and in compliance with data protection regulations. Here's an overview of our data handling practices: 1. Data Collection: We collect various types of personal data, including: - Candidate information: name, email, phone number, address, work experience, qualifications, and interview-related data. - Apprentice information: additional data collected during the apprenticeship cycle. 2. Data Storage: - Our web platform and client databases are hosted on AWS in London. - We use Google Workspace for email and file storage within the EU. - All data is stored within these cloud services. 3. Data Protection: - Encryption in Transit: We use strong encryption (TLS v. 1.2+) for data in transit. - Encryption at Rest: Data at rest is encrypted using AES 256 encryption. - Access Control: We implement strict access controls based on the principle of least privilege. 4. Data Backup: - Regular backups are conducted and stored securely. - Backups are encrypted and stored separately from the primary data store. 5. Data Processing: - We process personal data, including sensitive data as defined by GDPR (such as racial or ethnic origin and health data). - Data processing complies with GDPR and other relevant data protection laws. 6. Compliance and Security Measures: - We adhere to GDPR and other data protection regulations. - Regular security assessments, including penetration testing and vulnerability scans, are conducted.

Multiverse conducts penetration testing as part of the comprehensive approach to data security. Annual penetration tests on customer facing infrastructure is performed, to assess security posture and identify potential vulnerabilities. This is complemented by continuous scanning of the infrastructure to proactively detect and remediate any weaknesses, aligning with industry best practices.

Here's a bullet-point list of the key security measures in place at Multiverse: 1. Access Control and Authentication: - Multi-Factor Authentication (MFA) for remote access and internet-accessible systems - Role-Based Access Control (RBAC) - Principle of least privilege for system access - Regular access reviews and recertification (quarterly) - Strong password policies enforced 2. Encryption and Data Protection: - Data encrypted in transit using TLS 1.2+ - Data encrypted at rest using AES 256 - Secure key management practices 3. Network Security: - Zero Trust network architecture - Web Application Firewalls (WAF) for customer facing platforms - Secure DNS and browser content checking/blocking 4. Monitoring and Threat Detection: - Outsourced SOC and SIEM for real-time scanning and monitoring of applications and infrastructure - Continuous vulnerability scanning and penetration testing - Logging and monitoring of user activities, especially privileged access 5. Incident Response and Business Continuity: - Comprehensive Cyber Incident Response Plan - Formal Business Continuity Plan - Disaster Recovery Plan 6. Secure Development Practices: - Secure Software Development Lifecycle (SDLC) - Regular code reviews and static analysis - Automatic dependency updates (where possible) 7. Third-Party Risk Management: - Vendor due diligence and security assessments - Contractual security requirements for third-party service providers 8. Physical Security: - Access controls, manned reception, and CCTV in office locations - Secure disposal of confidential waste 9. Employee Security: - Regular security awareness training for all employees - Background checks for new employees 10. Compliance and Certifications: - ISO 27001:2022 certified - Cyber Essentials and Cyber Essentials Plus certified 11. Data Privacy: - Comprehensive data protection program - Dedicated Data Protection Officer - Regular Data Protection Impact Assessments (DPIAs) 12. Cloud Security: - Use of secure cloud…