Is this your company? Buyers are checking Sovos here. Claim sovos.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Sovos
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Sovos is SOC 2 Type II compliant. Sovos also holds ISO 27001, GDPR, and CCPA.
About
Sovos Compliance has implemented a comprehensive security program covering all aspects of Information Security and with the intention of providing defense in depth for the protection of Sovos systems and sensitive customer information. The program is designed around the concept of utilizing the ‘least common denominator’ control – that is, the most restrictive control required by a governing regulation, law, customer requirement, or industry best practice - and applying that control to all environments and aspects of the business. This approach allows Sovos to easily meet and normally exceed a
Compliance & infrastructure
Documents
16Documents
- Form_W-9_Sovos_Compliance_LLC_Line_1_2024.11.11Public
- SubprocessorsRequest
- Certificate of Insurance - 1M CGL, 2M Umbrella Updated.pdfRequest
- Certificate of Insurance - 1M CGL, 2M Umbrella, 5M Cyber Updated.pdfRequest
- DIAG »TRR » TIR-Enterprise Architecture DiagramsRequest
- DIAG - CN.pdfRequest
- CN DR Plan.pdfRequest
- TrustWeaver » eIDAS » CertificatePublic
- F.I.T ISO 20000-1 EMEA TRPublic
- Sovos Global Sanctions Export Control Policy April 2026.pdfRequest
- Sovos Whistleblowing Policy April 2026.pdfRequest
- Sovos Anti-Bribery Anti-Corruption Policy April 2026.pdfRequest
- Sovos Anti-Tax Evasion Policy April 2026.pdfRequest
- Sovos Supplier Code of Conduct April 2026.pdfRequest
- Sovos Sustainability Policy - April 2026.pdfRequest
- Sovos Antitrust Competition Policy April 2026.pdfRequest
Compliance leadership
The person who leads Sovos's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Sovos's penetration test vendor isn't listed yet.
Claim this profile to add it.
Recent updates
Sovos appoints Accenture as new subprocessor for Support!Nov 2024
Who is Accenture, and what role will they serve? Accenture is a global professional services company that has decades of experience in IT services, consulting, and digital transformation. Known for its expertise in strategy, technology, and operations, Accenture will be handling and supporting our ticketing system, carrying out first-line troubleshooting of issues and errors reported to Sovos. By strengthening our capabilities on this front, we strive to enhance our responsiveness and service quality, helping us to deliver timely assistance for all your needs.
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Sovos SOC 2 compliant?
Sovos is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Sovos ISO 27001 certified?
According to Sovos's public trust center, Sovos is ISO 27001 certified. On SOC2C this listing is Listed.
Is Sovos GDPR compliant?
According to Sovos's public trust center, Sovos is GDPR compliant. On SOC2C this listing is Listed.
Is Sovos CCPA compliant?
According to Sovos's public trust center, Sovos is CCPA compliant. On SOC2C this listing is Listed.
Is Sovos SOC 2 Type I or Type II?
Sovos is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Sovos's SOC 2 for a vendor risk assessment?
Yes. Sovos's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Sovos penetration tested?
Sovos hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Sovos secure?
Security isn't a single yes/no, but Sovos is SOC 2 Type II compliant and holds ISO 27001, SOC 2 Type II, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Sovos have a bug bounty or vulnerability disclosure program?
Sovos hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@sovos.com or via a /security page (Sovos lists a security contact).
Who are Sovos's subprocessors?
Sovos's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Sovos host or store data?
Sovos's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Sovos's trust center or security page?
Sovos's trust center is at https://trustcenter.sovos.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
What types of data will the new sub processor have access to?
Accenture will only have access to customer data that is provided by you when reaching out to our support. You control what data we process on your behalf. Most support requests do not require you to share personal data with us, but occasionally non-sensitive data (typically name surname and address) may be included. As such, we have strict data protection policies in place with Accenture to protect your data.
How is data protected with Accenture?
We have conducted a thorough evaluation of Accenture to ensure they meet our stringent security and data protection standards. All our contractual commitments with your company will be met by Sovos and any third party involved in the delivery of our products and services, including Accenture. All data shared with them is safeguarded using robust security measures, including encryption, access controls, and continuous monitoring, as described in Sovos Data Security Schedule.
Will this new sub processor impact data processing locations?
Accenture will have limited access to your data. This partnership does not alter the processing location of our Products or the location of storage of your data. Your data may temporarily be processed by Accenture for the sole purposes of addressing your support needs, and where that takes place in a third country Sovos has agreed to Standard Contract Clauses to guarantee an adequate level of protection in the occasional processing of your personal data.
Why is this new subprocessor being appointed?
By partnering with Accenture, we can enhance our support services with new capabilities such as live chats, reduce response times, and ensure that you receive timely and effective assistance whenever you need it. This appointment is part of our commitment to continuously improving our service quality.
How does this change impact on our contract or Data Processing Agreement (DPA)?
This appointment does not require changes to your existing contract or Data Processing Agreement. However, we have updated our list of subprocessors, as outlined in our DPA, to include Accenture. This list is accessible here.
How can I get more information about security or raise concerns about the new subprocessor?
Please contact customer support to get more information. Thank you for your continued trust. If you want to learn more about this, do not hesitate to reach out to our support team by emailing europesupport@sovos.com
Do you have a Data Protection Officer in charge of privacy?
Sovos has an appointed Data Protection Officer in place.
Do you have a privacy policy in place?
https://sovos.com/privacy-policy/
Are you ISO 27001 certified?
Sovos is ISO 27001 certified, and our data centers are evaluated against the SSAE 16 controls and receive at a minimum a SOC II Type II report on an annual basis.
Do you have an Information security policy in place?
Sovos's Security program is established via a formal information security policy approved by executive leadership and supporting documentation such as policies to provide guidance and direction, standards to define requirements, plans and procedures for consistent execution of requirements. All are reviewed, updated and approved annually.
Is the data encrypted in transit AND at rest?
All data in transit is protected by TLS 1.2 and above using only non-deprecated ciphers and at rest is encrypted via AES 256 bit. FIPS 140-2 Level 3 certified encryption management and key storage is utilized.
Do you perform regular security awareness traning for all employees?
All employees are required to take and pass security awareness trainings upon joining and on an annual basis at least. Developers are required to take and pass an annual secure coding training program on an annual basis. Additional training is provided to employees based on role within the company (e.g., incident response training, data handling/protection training, etc.)
Business & Industrial peers that completed SOC 2
Newsworthy.ai
newsworthy.ai · United States · Business & Industrial
SOC 2 Type IIRenewal not public
1099-Prep
1099-prep.com · United States · Business & Industrial
SOC 2 Type IRenewal not public
Octopus Deploy
octopus.com · United Kingdom · Business & Industrial
SOC 2 Type IIRenewal not public
Ask Ai
ask-ai.com · Business & Industrial
SOC 2 Type IIRenewal not public