Reddy

Yes. Reddy's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Reddy hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Reddy is SOC 2 Type II compliant and holds SOC 2 Type II, HIPAA, PCI DSS, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Reddy hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@reddy.io or via a /security page (Reddy lists a security contact).

Reddy lists 9 subprocessors on its trust center, including Google Cloud Platform, Microsoft Azure, Anthropic, Deepgram, ElevenLabs. Buyers use this for fourth-party risk review.

Reddy hosts on AWS, GCP, Azure. Data residency details are on its trust center.

Reddy's trust center is at https://trust.reddy.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

We take a multi-layered approach to security, implementing strong controls at every level of our platform. Key measures include: - Enterprise-Grade Infrastructure: Reddy is hosted on leading cloud infrastructure with robust network security. We utilize virtual private clouds, firewalls, and continuous monitoring to safeguard our perimeter and prevent unauthorized access . - Encryption Everywhere: All customer data is encrypted both in transit and at rest. We use TLS (HTTPS) to protect data in transit, and AES-256 encryption to secure data at rest in our databases. This means your information is unreadable to unauthorized parties at all times. - Strong Access Controls: We enforce strict access control and authentication for our systems. Internally, Reddy uses single sign-on (SSO) with multi-factor authentication (MFA) for all employees, and we apply role-based access control with least privilege principles. Only authorized personnel with a business need can access customer data, and all access is logged and audited for accountability. - Secure Development Practices: Security is built into our development lifecycle. Our engineering team performs code reviews, uses automated security scans, and undergoes secure coding training to prevent vulnerabilities . We fix issues promptly to keep the platform safe.

Yes. We regularly test our platform’s security both internally and with independent auditors. Reddy undergoes third-party penetration tests to probe for any vulnerabilities in our infrastructure and applications . In addition to annual pen tests, we use continuous vulnerability scanning and monitoring to catch issues year-round. Our security team follows industry best practices to triage and prioritize any identified vulnerabilities for quick resolution . Furthermore, as part of our SOC 2 audits and other compliance efforts, our controls are examined by external assessors to ensure we meet security standards. This proactive approach—regular audits, testing, and fast remediation—helps ensure Reddy’s platform remains secure and trustworthy.

We encourage responsible disclosure and take security reports seriously. If you believe you’ve found a vulnerability or security issue in our platform, please contact our security team immediately at [Security@reddy.io](mailto:Security@reddy.io) with the relevant details. Thank you for helping us keep Reddy secure.

Yes. Reddy is HIPAA compliant – as noted above, we have implemented the necessary safeguards (administrative, technical, and physical) to protect Protected Health Information (PHI) . For our healthcare customers, we are happy to sign a Business Associate Agreement (BAA) that formalizes our responsibilities when handling your PHI. We ensure that any ePHI processed through Reddy is encrypted and access to it is strictly limited, in line with HIPAA requirements. Our team is trained on HIPAA privacy and security rules so that they understand how to manage health data appropriately. If you’re in a regulated healthcare industry, you can trust that Reddy will work with you to meet compliance needs and will execute a BAA to give you contractual assurance of our HIPAA obligations. Please contact us to initiate a BAA as part of your onboarding if required.

Yes. All customer data is encrypted in transit via TLS 1.2+ and at rest using industry-standard AES-256 encryption keys managed by our cloud provider. Keys are rotated on a scheduled basis, and access to key-management systems is restricted to a small, audited group of engineers.

Absolutely. Reddy integrates with leading identity providers—including Okta, Azure AD, Google Workspace and any SAML 2.0-compliant IdP—so your administrators can enforce centralized MFA, SCIM user-lifecycle management, and granular role mapping.

We run 24 × 7 × 365 monitoring that includes: - Centralized logging & SIEM: Real-time ingestion of application, network and infrastructure logs into CrowdStrike with automated anomaly detection rules. - Intrusion detection & threat intel: Managed IDS/IPS and threat-intel feeds flag suspicious traffic, correlated against baselines. - Automated alerting & on-call: PagerDuty alerts route immediately to our security on-call rotation; incidents are triaged under our NIST-based IR plan. - Continuous vulnerability scanning: Weekly authenticated scans plus container image scanning during CI/CD.