Reddy

Yes. Reddy's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Reddy hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Reddy is SOC 2 Type II compliant and holds SOC 2 Type II, HIPAA, PCI DSS, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Reddy hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@reddy.io or via a /security page (Reddy lists a security contact).

Reddy lists 9 subprocessors on its trust center, including Google Cloud Platform, Microsoft Azure, Anthropic, Deepgram, ElevenLabs. Buyers use this for fourth-party risk review.

Reddy hosts on AWS, GCP, Azure. Data residency details are on its trust center.

Reddy's trust center is at https://trust.reddy.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We recommend checking out our Status Page: https://status.reddy.io/. This will give you the ability to subscribe for updates, view uptimes, be informed of any outages, and view historical data.

Your data in Reddy is stored on secure servers within our cloud environment. By default, we host data in the United States in trusted data centers operated by Google Cloud Provider (GCP). All data remains within our controlled environment; we do not offload customer data to unknown third parties. If you have specific data residency requirements, Reddy can support regional hosting requests.

Reddy only collects data that is necessary to provide our service—such as simulation interactions, performance metrics, and transcripts needed for training and assisting your agents on live calls. We do not use your company’s data to train our general AI models or share it with other customers. Your data is isolated to your organization’s use of Reddy and is never mingled or reused externally. In addition, we minimize sensitive personal information in our system. Reddy does not require storing highly sensitive data like credit card numbers or government IDs for our simulations or analytics. We focus on operational data (e.g. QA scores, conversation content) and do not retain regulated personal data whenever possible . This means your data remains under your control and is only used to serve your team’s training and performance needs.

Access to customer data within Reddy is highly restricted and monitored. Only a small number of authorized Reddy personnel — those who need access to support your account or maintain the system — can reach customer data, and only with management approval and on an as-needed basis. We have robust internal controls: all employees must use company SSO credentials with MFA to access our systems, and permissions are limited by role (principle of least privilege) . Administrative access to production databases or servers is logged and audited, so every action is tracked. We also require strict confidentiality agreements with our staff and provide regular security training so that everyone understands how to handle customer data responsibly.

Reddy maintains rigorous security and privacy compliance. We are SOC 2 Type II attested and have achieved HIPAA and PCI DSS compliance to protect sensitive data. We also adhere to global data protection regulations like GDPR and CCPA, ensuring our practices meet international standards for privacy . These certifications and frameworks demonstrate Reddy’s commitment to keeping your data secure and compliant with industry requirements.

We take a multi-layered approach to security, implementing strong controls at every level of our platform. Key measures include: - Enterprise-Grade Infrastructure: Reddy is hosted on leading cloud infrastructure with robust network security. We utilize virtual private clouds, firewalls, and continuous monitoring to safeguard our perimeter and prevent unauthorized access . - Encryption Everywhere: All customer data is encrypted both in transit and at rest. We use TLS (HTTPS) to protect data in transit, and AES-256 encryption to secure data at rest in our databases. This means your information is unreadable to unauthorized parties at all times. - Strong Access Controls: We enforce strict access control and authentication for our systems. Internally, Reddy uses single sign-on (SSO) with multi-factor authentication (MFA) for all employees, and we apply role-based access control with least privilege principles. Only authorized personnel with a business need can access customer data, and all access is logged and audited for accountability. - Secure Development Practices: Security is built into our development lifecycle. Our engineering team performs code reviews, uses automated security scans, and undergoes secure coding training to prevent vulnerabilities . We fix issues promptly to keep the platform safe.

Yes. We regularly test our platform’s security both internally and with independent auditors. Reddy undergoes third-party penetration tests to probe for any vulnerabilities in our infrastructure and applications . In addition to annual pen tests, we use continuous vulnerability scanning and monitoring to catch issues year-round. Our security team follows industry best practices to triage and prioritize any identified vulnerabilities for quick resolution . Furthermore, as part of our SOC 2 audits and other compliance efforts, our controls are examined by external assessors to ensure we meet security standards. This proactive approach—regular audits, testing, and fast remediation—helps ensure Reddy’s platform remains secure and trustworthy.

We encourage responsible disclosure and take security reports seriously. If you believe you’ve found a vulnerability or security issue in our platform, please contact our security team immediately at [Security@reddy.io](mailto:Security@reddy.io) with the relevant details. Thank you for helping us keep Reddy secure.

Yes. Reddy is HIPAA compliant – as noted above, we have implemented the necessary safeguards (administrative, technical, and physical) to protect Protected Health Information (PHI) . For our healthcare customers, we are happy to sign a Business Associate Agreement (BAA) that formalizes our responsibilities when handling your PHI. We ensure that any ePHI processed through Reddy is encrypted and access to it is strictly limited, in line with HIPAA requirements. Our team is trained on HIPAA privacy and security rules so that they understand how to manage health data appropriately. If you’re in a regulated healthcare industry, you can trust that Reddy will work with you to meet compliance needs and will execute a BAA to give you contractual assurance of our HIPAA obligations. Please contact us to initiate a BAA as part of your onboarding if required.

Yes. All customer data is encrypted in transit via TLS 1.2+ and at rest using industry-standard AES-256 encryption keys managed by our cloud provider. Keys are rotated on a scheduled basis, and access to key-management systems is restricted to a small, audited group of engineers.

Absolutely. Reddy integrates with leading identity providers—including Okta, Azure AD, Google Workspace and any SAML 2.0-compliant IdP—so your administrators can enforce centralized MFA, SCIM user-lifecycle management, and granular role mapping.

We run 24 × 7 × 365 monitoring that includes: - Centralized logging & SIEM: Real-time ingestion of application, network and infrastructure logs into CrowdStrike with automated anomaly detection rules. - Intrusion detection & threat intel: Managed IDS/IPS and threat-intel feeds flag suspicious traffic, correlated against baselines. - Automated alerting & on-call: PagerDuty alerts route immediately to our security on-call rotation; incidents are triaged under our NIST-based IR plan. - Continuous vulnerability scanning: Weekly authenticated scans plus container image scanning during CI/CD.