Is this your company? Buyers are checking Sitoo AB here. Claim sitoo.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Sitoo AB
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Sitoo AB is SOC 2 Type II compliant. Sitoo AB also holds ISO 27001, and GDPR.
About
Sitoo offers a cloud-native Unified Commerce Platform anchored by a Point of Sale (iOS and Android) for global retailers. Continuous POS and Platform upgrades, and new functionality is made available for everyone through the concept of Software as a Service (SaaS). *Sitoo utilises the ISO 27001 Information Security framework in order to identify and maintain the assets, technologies, and processes needed to protect Sitoo services to our customers and their information to help ensure the confidentiality, integrity, availability, and privacy of customer data and supporting services.*
Compliance & infrastructure
Hosting
AWS
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
3Subprocessors
5- AAmazon Web Services · Cloud Service ProviderEU
- SSalesforce · Customer SupportEU
- OOnitio · Customer SupportEU
- GGoogle Workspace · Productivity platformEU
- ZZendesk · Customer SupportEU
Compliance leadership
The person who leads Sitoo AB's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Sitoo AB's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
7/11 details · 64%SOC2C shows the verified essentials. 4 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Sitoo AB SOC 2 compliant?
Sitoo AB is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Sitoo AB ISO 27001 certified?
According to Sitoo AB's public trust center, Sitoo AB is ISO 27001 certified. On SOC2C this listing is Listed.
Is Sitoo AB GDPR compliant?
According to Sitoo AB's public trust center, Sitoo AB is GDPR compliant. On SOC2C this listing is Listed.
Is Sitoo AB SOC 2 Type I or Type II?
Sitoo AB is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Sitoo AB's SOC 2 for a vendor risk assessment?
Yes. Sitoo AB's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Sitoo AB penetration tested?
Sitoo AB hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Does Sitoo AB offer a Data Processing Agreement (DPA)?
Sitoo AB publishes a DPA on its trust center; you can request access through SOC2C.
Can I get Sitoo AB's SOC 2 report?
Sitoo AB's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Sitoo AB secure?
Security isn't a single yes/no, but Sitoo AB is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Sitoo AB have a bug bounty or vulnerability disclosure program?
Sitoo AB hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@sitoo.com or via a /security page (Sitoo AB lists a security contact).
Who are Sitoo AB's subprocessors?
Sitoo AB lists 5 subprocessors on its trust center, including Amazon Web Services, Salesforce, Onitio, Google Workspace, Zendesk. Buyers use this for fourth-party risk review.
Where does Sitoo AB host or store data?
Sitoo AB hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.
Does Sitoo AB offer a Data Processing Agreement (DPA)?
Sitoo AB publishes a DPA on its trust center. You can request access through SOC2C.
Where is Sitoo AB's trust center or security page?
Sitoo AB's trust center is at https://trust.sitoo.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
How do you protect your service from ransomware?
Besides following general best practice with security testing of our products Sitoo POS client is only available on iOS and Android that are less prone platforms for ransomware attacks. Sitoo also uses the official app stores from Apple and Google, App Store and Google Play, for the distribution of the client POS app. Apps are digitally signed by Sitoo for Sitoo POS and then each new version is reviewed by Apple and Google before release. You as a customer must of course do your part and make sure that you continuously work with updating the operating systems and the Sitoo POS app. Our backend in AWS is continuously running backups and is running on an “serverless” infrastructure provided by AWS that also reduces the likelihood of ransomware affecting our services. In the event of a disruption of our backend services like the one discussed here, the most important operational thing is to be able to still provide service to customers in the store and fulfil the customer promise. This can, for instance, be handled via Sitoo's offline mode and the possibility of having several different payment methods, such as Klarna and Swish, and putting payment terminals in offline mode for a period of time. Unfortunately when it comes to security, nothing is impossible and no system in the world is ever going to be 100% secure from an attack. Make sure that you have business and disaster recovery plans in place.
Are you PCI DSS compliant?
Sitoo has integrations with market leading PCI compliant payment providers. The payment providers handle sensitive credit card data according to PCI DSS (Payment Card Industry Data Security Standards). *In other words Sitoo is not part of the PCI scope.*
Retail & Commerce peers that completed SOC 2
Paella Inc
crossmint.com · United States · Retail & Commerce
SOC 2 Type IIRenewal not public
Joshu Inc
joshuins.com · United States · Retail & Commerce
SOC 2 Type IIRenewal not public
Wrks
wrks.me · Retail & Commerce
SOC 2 Type IIRenewal not public
Engine
engine.net · United States · Retail & Commerce
SOC 2 Type IIRenewal not public