Question 1

Is Solvimon SOC 2 compliant?

Accepted Answer

Solvimon is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Solvimon ISO 27001 certified?

Accepted Answer

According to Solvimon's public trust center, Solvimon is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Solvimon GDPR compliant?

Accepted Answer

According to Solvimon's public trust center, Solvimon is GDPR compliant. On SOC2C this listing is Listed.

Question 4

Is Solvimon SOC 2 Type I or Type II?

Accepted Answer

Solvimon is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 5

Can I use Solvimon's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Solvimon's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 6

Is Solvimon penetration tested?

Accepted Answer

Solvimon hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 7

Is Solvimon secure?

Accepted Answer

Security isn't a single yes/no, but Solvimon is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 8

Does Solvimon have a bug bounty or vulnerability disclosure program?

Accepted Answer

Solvimon hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@solvimon.com or via a /security page (Solvimon lists a security contact).

Question 9

Who are Solvimon's subprocessors?

Accepted Answer

Solvimon lists 5 subprocessors on its trust center, including Google Cloud Platform, Adyen N.V., Mailgun, Embeddable, Paragon. Buyers use this for fourth-party risk review.

Question 10

Where does Solvimon host or store data?

Accepted Answer

Solvimon hosts on GCP, and handles Credit card information, Personal health information, PII Data (only in case an invoice is directly issued by Solvimon to a consumer), Employee personally identifiable information (User credentials & Billing Contact Detals). Data residency details are on its trust center.

Question 11

Where is Solvimon's trust center or security page?

Accepted Answer

Solvimon's trust center is at https://trust.solvimon.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Question 12

Entity Details for contracting

Accepted Answer

SOLVIMON B.V., a company with limited liability (besloten vennootschap met beperkte aansprakelijkheid), with its statutory seat in Utrecht, its registered offices at Daalsesingel 51, 3511 SW, Utrecht, the Netherlands and registered with the commercial register of the Dutch Chamber of Commerce (Handelsregister van de Kamer van Koophandel) under number 86385879 (“Solvimon”).

Question 13

Do you encrypt data between your solution and the customer

Accepted Answer

These are encrypted through a secured line with a TLS 1.3 certificate

Question 14

The minimal and recommend TLS version if used

Accepted Answer

TLS 1.3

Question 15

The type of cryptographic key used, its size, the generation method, the storage security at usage

Accepted Answer

Issued by certificate authority, AES algorithm, 128 bit keys

Question 16

are network flow logged ? Where and what are the retention ?

Accepted Answer

We are following GCP best practices and have VPC flow logs enabled

Question 17

How are customer data protected when used or stored ? Are encryption mandatory for all data at rest ? How is it implemented ?

Accepted Answer

Yes, we follow GCP standards. All data at rest is encrypted

Solvimon

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

Recent updates

This listing is partial

Frequently asked