Question 1

Is The Predictive Index SOC 2 compliant?

Accepted Answer

The Predictive Index is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is The Predictive Index ISO 27001 certified?

Accepted Answer

According to The Predictive Index's public trust center, The Predictive Index is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is The Predictive Index PCI DSS compliant?

Accepted Answer

According to The Predictive Index's public trust center, The Predictive Index is PCI DSS compliant. On SOC2C this listing is Listed.

Question 4

Is The Predictive Index NIST CSF compliant?

Accepted Answer

According to The Predictive Index's public trust center, The Predictive Index is NIST CSF compliant. On SOC2C this listing is Listed.

Question 5

Is The Predictive Index SOC 2 Type I or Type II?

Accepted Answer

The Predictive Index is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 6

Can I use The Predictive Index's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. The Predictive Index's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 7

Is The Predictive Index penetration tested?

Accepted Answer

The Predictive Index hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 8

Is The Predictive Index secure?

Accepted Answer

Security isn't a single yes/no, but The Predictive Index is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, PCI DSS, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 9

Does The Predictive Index have a bug bounty or vulnerability disclosure program?

Accepted Answer

The Predictive Index hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@predictiveindex.com or via a /security page.

Question 10

Who are The Predictive Index's subprocessors?

Accepted Answer

The Predictive Index lists 30 subprocessors on its trust center, including Auth0, CircleCI, ChurnZero, Datadog, Domo. Buyers use this for fourth-party risk review.

Question 11

Where does The Predictive Index host or store data?

Accepted Answer

The Predictive Index hosts on Azure. Data residency details are on its trust center.

Question 12

Where is The Predictive Index's trust center or security page?

Accepted Answer

The Predictive Index's trust center is at https://trust.predictiveindex.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 13

Do you provide a public status page that displays real-time and historical uptime information for your services?

Accepted Answer

https://status.predictiveindex.com

Question 14

Do you encrypt data at rest?

Accepted Answer

Yes. We have strong encryption for the data at rest (while it is stored) and in transit (while it is being transmitted). Our production assets only allow TLS 1.3 or above. The access to the stored customer data is on a Need to Know basis. Typical personnel who are authorized to access are Customer Support and Engineering Developers while troubleshooting issues and DevOps personnel for deploying services.

Question 15

Where are your servers located?

Accepted Answer

The Predictive Index servers are hosted on Microsoft Azure in the eastern USA.

Question 16

I found a security bug. Do you have an established bug bounty program?

Accepted Answer

Please visit this page for more information: https://www.predictiveindex.com/security/responsible-disclosure/ Please submit your findings to (vulns@predictiveindex.com) and include the following: 1. Location of the vulnerability. 2. Full description of the vulnerability being reported, including exploitability and impact. 3. Steps to replicate the vulnerability. 4. Supporting evidence such as screenshots, traffic logs, requests and responses. Please keep information about the vulnerability confidential until we review and resolve the issue. The timeframe for resolution depends on factors such as the severity, exploitability, and impact of the vulnerability, and the complexity of the solution. We will confirm the expected timeframe for resolution with you following the disclosure of the vulnerability.

Question 17

Do you support Single Sign-On (SSO)?

Accepted Answer

SSO is a high priority for future inclusion but not yet supported. For authentication, the web application uses Oauth 2.0 by Auth0 and is managed by our software engineers. Our software supports MFA, and SSO is on our roadmap. More information can be found here: - https://docs.predictiveindex.com/admin-guide/account-creation/single-sign-on-sso/ - https://www.predictiveindex.com/learn/support/multi-factor-authentication/

Question 18

What Security settings are available?

Accepted Answer

Security settings include Role-Based Access Control, encryption, firewalls, multifactor authentication, and regular reviews. We have strong security controls in the product, including Role-Based Access Control (RBAC), Data Segregation, Data Anonymization, and Login Attack Protection. PI application’s RBAC has six different user roles, helping ensure that our customers have the ability to provide their users the right level of access. The PI RBAC also has a role for 3rd party users, enabling our customers to securely share data with consultants. Our data segregation features provide the ability to restrict access to the data within the application. This enables our customers to segregate data, for instance, by organizational unit or geographical location, so that only users that are responsible for those organizational units or geographical locations could be provided access to the data. We utilize industry-leading Auth0 as the identity and access management partner in our product. User logins into our application are secured by Auth0. Our product utilizes the Auth0 attack protection features in order to prevent malicious activities such as brute-forcing.

Question 19

Could you provide an attestation or summary of your most recent penetration test, including the scope of the assessment and confirmation that any identified vulnerabilities have been addressed?

Accepted Answer

We prioritize the security of our systems and data by conducting annual penetration tests through reputable third-party security firms. These assessments are comprehensive and designed to identify vulnerabilities that could impact our security posture. While we do not publicly disclose the detailed results of these penetration tests to maintain security integrity, we undergo annual security compliance audits. During these audits, independent third-party auditors verify that thorough testing is conducted and that any identified findings are promptly addressed. This process ensures that our security measures are not only effective but also continuously improved upon.

Question 20

What categories of personal data does Predictive Index collect from its customers and users?

Accepted Answer

Our Services Privacy Policy provides a detailed chart describing the types of personal data we collect from our customers and users. The policy also explains the purposes for which we collect the data and how it may be shared with third parties. For a comprehensive understanding of how we handle personal data, we encourage you to review the entire policy. If you have any questions or require further clarification, please feel free to contact us at [privacy@predictiveindex.com](mailto:privacy@predictiveindex.com).

The Predictive Index

About

Compliance & infrastructure

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked

Business & Industrial peers that completed SOC 2

Newsworthy.ai

1099-Prep

Octopus Deploy

Ask Ai