Is this your company? Buyers are checking Sleuth here. Claim sleuth.io free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Sleuth
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Sleuth is SOC 2 Type II compliant.
About
Track and improve Engineering Efficiency. You can't improve what you don't measure. Sleuth lets you do both. Security is very important to us. We follow industry best practices for protecting your organization. Sleuth is SOC2 Type 2 compliant. Sleuth runs a ongoing bug bounty program within Bugcrowd. All security issues are addressed within set and monitored SLAs.
Compliance & infrastructure
Data handled
Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information
Documents
16POLICIES
- Change Management PolicyPublic
- System Access Control PolicyPublic
- Information Security PolicyPublic
- Data Classification PolicyPublic
- Data Protection PolicyPublic
- Incident Response PlanPublic
- Physical Security PolicyPublic
- Disaster Recovery PlanPublic
- Business Continuity PlanPublic
- Password PolicyPublic
- Risk Assessment ProgramPublic
- Cryptography PolicyPublic
- Acceptable Use PolicyPublic
Compliance leadership
The person who leads Sleuth's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Sleuth's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
4/11 details · 36%SOC2C shows the verified essentials. 7 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Sleuth SOC 2 compliant?
Sleuth is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Sleuth SOC 2 Type I or Type II?
Sleuth is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Sleuth's SOC 2 for a vendor risk assessment?
Yes. Sleuth's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Sleuth penetration tested?
Sleuth hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Can I get Sleuth's SOC 2 report?
Sleuth's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.
Is Sleuth secure?
Security isn't a single yes/no, but Sleuth is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Sleuth have a bug bounty or vulnerability disclosure program?
Sleuth hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@sleuth.io or via a /security page (Sleuth lists a security contact).
Who are Sleuth's subprocessors?
Sleuth's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Sleuth host or store data?
Sleuth's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Sleuth's trust center or security page?
Sleuth's trust center is at https://trust.sleuth.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
What kind of data does Sleuth store?
Sleuth stores data related to your organizations deployment process. Examples of information that Sleuth collects and stores are; Pull request titles and summaries, commit messages and author email addresses, Issue titles, summaries and status states, incident titles and metrics data. Sleuth stores a minimum of PII. This is limited to email address and full names and potentially linked external accounts of developers participating in your deployment process.
What region is Sleuth hosted in and where is your DR infrastructure?
Sleuth runs in an active-active Multi-AZ environment at all times in the AWS us-west-2 region. What this means is that we run multiple instances of our services across the 3 AZ's at all times, with auto-scaling enabled. For our Fargate services this means that if one AZ goes down the other two will continue to function and auto-scale to bring our total capacity back up to our normal levels. For our datastore's we have active replicas with auto-failover at the AZ level configured. So for RDS and Elasticache Redis, if their primary AZ instance goes down we will be automatically flipped over to the replica within 30 - 90 seconds. Our AWS OpenSearch instance runs with 3 nodes spread across AZ's. We maintain a streaming replica of our primary data source, RDS Postgres, in us-east-1 in case of a Region-level catastrophe.
Does Sleuth send data to AI providers?
Our Sleuth DORA offering doesn't send data to any AI providers. Our Sleuth Pulse offering does heavily interact with OpenAI and it's API's. What we are not sharing with OpenAI: - The names of your employees or customers - Your code - Issue descriptions or PR descriptions - User-generated comments Furthermore, we are not training any internal models of our own. What we are sharing: - PR titles and IDs - Issue titles and IDs - Sleuth-generated quantitative analyses of those PRs and Issues (e.g. time spent in various workflow states) - Depending on which specific widgets users configure, we may also share Jira labels, Jira project names, and other high-level Jira “metadata” that users opt to include as groupings in widgets
Business & Industrial peers that completed SOC 2
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public