Is S2 Cognition LLC PIPEDA compliant?

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is PIPEDA compliant. On SOC2C this listing is Listed.

Can I use S2 Cognition LLC's SOC 2 for a vendor risk assessment?

Yes. S2 Cognition LLC's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is S2 Cognition LLC penetration tested?

S2 Cognition LLC hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Is S2 Cognition LLC secure?

Security isn't a single yes/no, but S2 Cognition LLC is SOC 2 compliant and holds PCI DSS, CMMC, CSA STAR, CCPA, PIPEDA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does S2 Cognition LLC have a bug bounty or vulnerability disclosure program?

S2 Cognition LLC hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@s2cognition.com or via a /security page (S2 Cognition LLC lists a security contact).

Who are S2 Cognition LLC's subprocessors?

S2 Cognition LLC lists 7 subprocessors on its trust center, including Microsoft 365, monday.com, Adobe, Klaviyo, Slack. Buyers use this for fourth-party risk review.

Where does S2 Cognition LLC host or store data?

S2 Cognition LLC's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Where is S2 Cognition LLC's trust center or security page?

S2 Cognition LLC's trust center is at https://trust.s2cognition.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking S2 Cognition LLC here. Claim s2cognition.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

S2 Cognition LLC

s2cognition.com · United States · Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

S2 Cognition LLC is SOC 2 compliant. S2 Cognition LLC also holds PCI DSS, CMMC, CSA STAR, CCPA, and PIPEDA.

Request report access Claim this profile

Framework

SOC 2

Auditor

Not publicAdd

Last report

—Add

Renewal

UnknownAdd

View official trust center ↗

About

Welcome to S2 Cognition’s Trust Center. Security and privacy aren’t afterthoughts—they’re built into our product from the ground up. Our secure‑by‑design platform embeds Information Security and Data Privacy principles at every layer of our business and technology stack. Through this portal, you can explore our security and privacy posture and request access to supporting documentation. Please note that certain Trust Center materials require a valid non‑disclosure agreement (NDA), which may be completed after you submit a documentation request. Founded in 2015 by former college athletes and co

Compliance & infrastructure

PCI DSSCMMCCSA STARCCPAPIPEDA

Data handled

Customer personally identifiable informationEmployee personally identifiable information

Subprocessors

M
Microsoft 365 · Collaboration, Communications, Productivity
United States
m
monday.com · Customer Relationship Management
United States
A
Adobe · Invoices, Legal Contracts
United States
K
Klaviyo · Marketing Communications
United States
S
Slack · Collaboration
United States
A
Authorize.net · Payment Gateway Service Provider
United States
S
Square · Payment Gateway Service Provider
United States

Compliance leadership

The person who leads S2 Cognition LLC's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. S2 Cognition LLC's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Scheduled System MaintenanceFeb 2026

We will be undergoing a system upgrade on Sunday, February 8th, from 00:00 UTC through 00:00 UTC on February 9, 2026. During this time, the following services will be affected: - Public Services - Portal - S2 Evaluation - Backend Services - Web API Services - Asset Management API Services - Evaluation API Services - Scoring API Services Additional details are available at: https://s2cognition.statuspage.io/

S2 Cognition Privacy Policy updatedJan 2026

S2 Cognition Privacy Policy We’ve updated our Privacy Policy to clarify how we handle SMS and mobile communications data, reinforcing our commitment to transparency and responsible data use. Key Change: SMS and Mobile Communications Privacy: We have added a dedicated section to explicitly state that mobile phone numbers and SMS opt-in data are not sold, shared, rented, or disclosed to third parties for marketing or promotional purposes. SMS opt-in information is used solely to deliver messages that users have explicitly consented to receive, such as operational, service-related, or security communications. Any SMS data processing by service providers is limited to delivering messaging services and is subject to confidentiality and data protection obligations. Mobile opt-in data is shared only as required to provide SMS services or to comply with legal requirements. This update is effective immediately. You can review the full, updated Privacy Policy and all past updates on the S2 Cognition Trust Center: https://trust.s2cognition.com/updates Your continued use of our Services constitutes acceptance of these changes. If you have questions or need additional information, please contact our Privacy team at [Privacy@s2cognition.com](mailto:privacy@s2cognition.com).

S2 Cognition will once again pursue a SOC 2 Type II third-party attestation in 2026Jan 2026

SOC 2 is a security framework that specifies how organizations should protect customer data from unauthorized access, security incidents, and other vulnerabilities. The American Institute of Certified Public Accountants AICPA developed SOC 2 around five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. A SOC 2 audit report is the gold standard for third-party risk management. The SOC 2 report assures our customers and partners that we have the systems and controls in place to protect their critical business information.

S2 Cognition Successfully Renews SOC 2 Type II Compliance for 2025Nov 2025

S2 Cognition is pleased to announce the successful completion of its System and Organization Controls (SOC 2) Type II audit for this year, reaffirming our compliance with industry-leading standards for customer data security. This achievement demonstrates our continued commitment to maintaining a secure and resilient environment for our customers. Developed by the American Institute of Certified Public Accountants (AICPA), SOC 2 is an information security framework that validates controls relevant to security, availability, confidentiality, processing integrity, and privacy. The audit was completed with the support of Johanson Group LLP, a premier certification body that assists organizations in obtaining and maintaining global compliance standards. ### Why is security important at your company and what made you set out to get your SOC 2 compliance? Security is a core priority at our company because it protects sensitive information, preserves the trust of our clients, and ensures the reliability of our operations. Cyber threats continue to evolve, and strong security practices are essential for safeguarding customer data, proprietary information, and the continuity of our services. A security incident can have significant reputational, financial, and legal consequences. Our commitment to robust security practices reflects both our ethical responsibilities and our strategic…

Data Privacy Framework Re-Certification CompletedJul 2025

S2 Cognition has re-certified our compliance with the EU-U.S. Data Privacy Framework (EU-U.S. DPF), the UK Extension to the EU-U.S. DPF, and the Swiss-U.S. Data Privacy Framework (Swiss-U.S. DPF). Our active certification is publicly available on the DPF website.

This listing is partial

5/11 details · 45%

SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Hosting
Add where you host (AWS, GCP, Azure) and data residency.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is S2 Cognition LLC SOC 2 compliant?

S2 Cognition LLC is SOC 2 compliant. On SOC2C this listing is Listed.

Is S2 Cognition LLC PCI DSS compliant?

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is PCI DSS compliant. On SOC2C this listing is Listed.

Is S2 Cognition LLC CMMC compliant?

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CMMC compliant. On SOC2C this listing is Listed.

Is S2 Cognition LLC CSA STAR certified?

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CSA STAR certified. On SOC2C this listing is Listed.

Is S2 Cognition LLC CCPA compliant?

According to S2 Cognition LLC's public trust center, S2 Cognition LLC is CCPA compliant. On SOC2C this listing is Listed.

Show 8 more questions

Answers published by S2 Cognition LLC

Reproduced from S2 Cognition LLC's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Does S2 Cognition conform with a specific industry-standard security framework?

S2 Cognition's Information Security and Privacy Program establishes policies and controls, monitors compliance with those controls, and proves security and compliance to third-party auditors. The security policies and controls are grounded in the key principles of zero trust, least privilege, need-to-know, and segregation of duties, and govern access to facilities, systems, and data. The policies are refreshed annually, approved by senior management, and reviewed by independent auditors. S2 Cognition's Information Security & Privacy Program has created a security framework based on the National Institute of Standards and Technology (NIST) Special Publication (SP) 800-171 Rev. 2 (14) control families for the Protection of Controlled Unclassified Information in Non-Federal Information Systems and Organizations as the foundation for the S2 Cognition Information Security policy, standards, and controls. This is also in alignment with the family of (14) domains and controls found in the ISO 27001:2022 Standard and the AICPA SOC 2 Trust Services Criteria. S2 Cognition believes that the implementation of controls should be applied consistently across all areas of the enterprise, iterative, continuously maturing across the dimensions of improved effectiveness, and provide increased auditability and decreased friction.

Where are S2 Cognition's servers located?

S2 Cognition operates within Amazon Web Services (AWS). S2 Cognition leverages AWS components to provide reliable, fault-tolerant, and highly available systems in the cloud. AWS follows the Shared Responsibility Model. AWS is responsible for the security of the cloud, and S2 Cognition is responsible for security in the cloud. S2 Cognition's infrastructure is hosted in US-based AWS data centers housed in state-of-the-art facilities that maintain a highly secure server environment with 24x7 monitoring, surveillance, and support to prevent unauthorized access and ensure data security. Advanced security measures including firewalls, security guards, and surveillance are taken to ensure the continued service and protection of operational data from natural disasters, intruders, and disruptive events. These data centers meet industry standards such as ISO 27001:2022, SOC 2, CSA STAR CCM v4.0, FedRAMP, CMMC, etc. They are rigorously audited annually by third parties. If you are required to review the data center SOC report, you can review the latest AWS SOC 3 Report. Learn more about the AWS North America Regions and Availability Zones.

Does S2 Cognition encrypt sensitive data at rest and in transit?

All datastores with customer data, in addition to S3 buckets, are encrypted at rest using 256-bit Advanced Encryption Standard (AES) encryption. S2 Cognition uses the Amazon Web Services (AWS) Key Management Service (KMS) to enable data at rest encryption across S2 Cognition's products. S2 Cognition uses this for encrypting data within databases (RDS), and data stored within S3. AWS KMS uses the Advanced Encryption Standard (AES) algorithm in Galois/Counter Mode (GCM) with 256-bit secret keys. Data is logically separated and access is granted to authorized users only. S2 Cognition uses Transport Layer Security (TLS) 1.2/1.3 encryption and Hypertext Transfer Protocol Secure (HTTPS) for all data transported through S2 Cognition's network servers. S2 Cognition currently uses Load Balancer and CloudFront Security Policies supporting TLS 1.2 and higher. Details of this can be found here. All connections to S2 Cognition's servers are protected by Secure Sockets Layer (SSL) encryption.

Does S2 Cognition conduct penetration tests and vulnerability scans?

S2 Cognition conducts an independent external penetration test annually and requires vulnerability scanning at key stages of the Secure Development Lifecycle (SDLC). All areas of S2 Cognition's products and cloud infrastructure are in-scope for these assessments. The S2 Cognition information security team performs monthly web application vulnerability scans. These scans are configured to run as authenticated scans. Any vulnerabilities found during these scans or any other vulnerability discovery activities are added to a vulnerability tracking system. There, the vulnerabilities are verified, categorized, and evaluated for actual risk. Vulnerabilities are remediated in accordance with the schedule listed below: The following SLA is followed for vulnerability findings based on a CVSS. Non-CVSS scored vulnerabilities with a risk score are determined by leveraging the OWASP Risk Rating Methodology (Risk = Likelihood \* Impact). - Critical Severity = 30 days - High Severity = 60 days - Medium Severity = Discretionary - Low Severity = Discretionary - Informational Severity = Discretionary If you feel you have discovered a security flaw in our system, you can submit any vulnerabilities by contacting the S2 Cognition information security team directly at [Security@s2cognition.com](mailto:security@s2cognition.com).

Does S2 Cognition have a Bug Bounty Program?

Security Notice – Responsible Disclosure At S2 Cognition, we are committed to protecting the confidentiality, integrity, and availability of our systems and data in accordance with our SOC 2 controls. While we do not currently offer a public bug bounty program, we encourage responsible disclosure of any identified vulnerabilities in our products or services. Your efforts help us maintain a secure and trustworthy environment. To report a potential security issue, please contact us at: [Security@s2cognition.com](mailto:security@s2cognition.com) When reporting, please include: - A clear description of the issue - Steps to reproduce the vulnerability - Any relevant technical details or tools used - Your contact information so we can follow up We will acknowledge your report within three (3) business days and maintain communication throughout our assessment and resolution process. Please do not publicly disclose any vulnerabilities without written permission from S2 Cognition. Responsible disclosure helps us strengthen our controls and reinforces our commitment to SOC 2 compliance. Thank you for supporting the security of our platform.

Does S2 Cognition maintain a risk management program, perform risk assessments, and track the treatment of those risks?

S2 Cognition has a risk management program in place and performs an annual company-wide risk assessment in addition to quarterly follow-up meetings with risk owners. S2 Cognition uses Vanta to manage and track these risks as they are mitigated and treated. The S2 Cognition risk management process is the integration of people, processes, and tools that continuously identify and mitigate enterprise risks. The risk assessment program includes the following: - Identification of enterprise risks - Assigning risks to risk owners - Review the impact and likelihood of risks - Implement mitigations to risks based on risk tolerance - Monitoring the effectiveness of risk mitigation S2 Cognition's risk management program provides stakeholders an enterprise-wide understanding of the risks to the organization, what is being done to manage those risks, and how effective the risk management program is performing. S2 Cognition's risk management program is reviewed as part of S2 Cognition's annual third-party audit (SOC 2). The risk management program is approved and supported by S2 Cognition's senior management and formal risk reporting to the Board of Directors is conducted which results in: - Ensuring accountability and competence for managing risks across the organization - Ensuring effective, relevant, and timely exchange of information with internal and external stakeholders - Support of decision-making processes fully aligned with risk exposure - Ensuring risk owners and governing bodies are provided with all relevant information to conduct their activities

Does S2 Cognition conduct security and privacy awareness training with its employees?

All S2 Cognition employees complete mandatory security awareness and privacy training upon hire and at least once annually. S2 Cognition conducts simulated phishing and social engineering tests on an ongoing basis at least once a month. All S2 Cognition employees and contractors sign confidentiality and non-disclosure agreements upon hire and before access to company or customer data. Security bulletins and announcements are shared throughout the year to give timely reinforcement reminders for awareness and education.

How does S2 Cognition deploy its architecture?

S2 Cognition follows best practice for the deployment and maintenance of its systems and for data maintained within S2 Cognition's data centers and cloud services. Systems are securely designed and are reviewed by the information security team before being put into production. The S2 Cognition Research and Development (R&D) team leverages a Continuous Integration / Continuous Delivery (CI/CD) pipeline for managing code deployments. Code changes are peer reviewed, approved by QA staff, and tested in a staging environment before they are pushed into production. The staging and production environments are logically separated, and no data is shared between them. Critical data and systems are replicated and backed up to secondary data centers. These backups are stored encrypted in accordance with the data encryption FAQ listed above.

What is S2 Cognition's approach to perimeter security?

S2 Cognition implements and layers security controls according to the principle of defense-in-depth, which ensures separation between production and lower environments, and between the public internet and non-public infrastructure components. S2 Cognition uses a combination of Amazon Web Services (AWS) Virtual Private Clouds (VPCs), VPC subnets, Network Access Controls Lists (NACLs), AWS Security Groups, and AWS DB Subnet Groups to provide logical network-level isolation. S2 Cognition protects data, servers, and endpoints using industry best security controls. These controls include next generation anti-virus/anti-malware, web security, email security, and Amazon GuardDuty for intelligent threat detection and continuous monitoring of any suspicious activity in our production systems. This allows S2 Cognition to prevent malicious network attacks, prevent access to suspicious or malicious sites, prevent malicious emails or attachments, and mitigate zero-day attacks. S2 Cognition also uses AWS Security Hub to automate security best practice checks, aggregate security alerts into a single place and format, and understand the overall security posture.

What identity and access management controls does S2 Cognition have in place?

Access and processing capabilities are limited to only those with a legitimate business need and granted based on the principle of least privilege. S2 Cognition employees are granted access to applications based on their role, and automatically deprovisioned upon termination of their employment. Further access must be approved according to the policies set for each application. A unique user ID with a complex password is assigned to authorized users and is required to login. Passwords are required to be changed frequently. Multi-factor authentication (MFA) is required for remote access and access to cloud systems. Administrative functions are facilitated through separate privileged accounts.

How does S2 Cognition configure and secure user devices across the Enterprise?

All corporate devices are centrally managed and are equipped with mobile device management (MDM) software and anti-malware protection. Endpoint security alerts are monitored with 24/7/365 coverage. S2 Cognition uses MDM software to enforce secure configuration of endpoints, such as disk encryption, screen lock configuration, and software updates.

What is S2 Cognition's perspective on Data Privacy?

S2 Cognition is committed to the protection and privacy of data. The protection and management of data entrusted to us is one of our highest priorities. S2 Cognition has appointed a Data Privacy Officer (DPO) and has a dedicated privacy team. The privacy team can be contacted at [Privacy@s2cognition.com](mailto:privacy@s2cognition.com). S2 Cognition follows a least privilege access model and regularly audits individuals' access to data. S2 Cognition respects individuals’ right to privacy and we are consistently working to remain compliant with privacy regulations. S2 Cognition’s Privacy Policy further details how customer data is handled.

Show 7 more questions

Sports peers that completed SOC 2

Compare vs Field Day Inc Compare vs Ease Live AS Compare vs Reboot Motion Inc