Stairwell

Stairwell hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Stairwell is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, ISO 27701. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Stairwell hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@stairwell.com or via a /security page (Stairwell lists a security contact).

Stairwell lists 5 subprocessors on its trust center, including Anthropic PBC, Google, LLC, Groq, Inc., Omni Analytics, Inc., OpenAI, LLC. Buyers use this for fourth-party risk review.

Stairwell hosts on GCP, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

Stairwell's trust center is at https://trust.stairwell.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Stairwell is a cybersecurity company that offers the Stairwell platform for security operations, digital forensics and incident response, threat intelligence, and threat hunting.

The Stairwell platform collects primary data through the ingestion of binary files and databases of binary files that have either compromised the security of organizations or been identified as malicious. This data is used to analyze potential and past attacks and identify patterns or potential future attacks. All customer and attack data are stored within Stairwell's Google Cloud environments.

Stairwell uses the following technologies and service providers: * Google Cloud for maintaining the Stairwell platform. * Various access control and encryption technologies to secure and protect confidential data transmitted through the Stairwell platform. * Secure/encrypted email and manual or automated processes for internal communication. * A help center external portal for clients to report issues or concerns with the Stairwell platform. Stairwell does not use any subcontractors to process PII.

The Stairwell platform is hosted in the cloud on Google Cloud.

The Stairwell platform has been certified against the ISO 27001 and ISO 27701 standards and maintains a SOC 2 Type II attestation.

The latest SOC 2 audit of the Stairwell platform covered the time period from January 1, 2023, to December 31, 2023.

The auditor opined that, in all material respects: 1. The \[system] description presents the Stairwell platform that was designed and implemented throughout the period January 1, 2023 to December 31, 2023 in accordance with the description criteria. 2. The controls stated in the description were suitably designed throughout the period January 1, 2023 to December 31, 2023 to provide reasonable assurance that Stairwell’s service commitments and system requirements would be achieved based on the applicable trust services criteria, if its controls operated effectively throughout that period and if the subservice organization and user entities applied the complementary controls assumed in the design of Stairwell controls throughout that period. 3. The controls stated in the description operated effectively throughout the period January 1, 2023 to December 31, 2023 to provide reasonable assurance that Stairwell’s service commitments and system requirements were achieved based on the applicable trust services criteria, if complementary subservice organization controls and complementary user entity controls assumed in the design of Stairwell’s controls operated effectively throughout that period.

1 of 5 sampled new hires did not complete the security awareness training within 45 days of onboarding.

Stairwell Management concurred with the test results and implemented additional monitoring and alerting to notify relevant personnel when new hires and employees have not completed the security awareness training and are within 10 business days of the required completion date. The employee, their manager, and the Head of Compliance receive these notifications, and, per an updated procedure, the Head of Compliance contacts the employee directly to remind the employee of their obligation. These contacts occur on the 10th, 8th, 6th, 4th, 3rd, 2nd, and 1st business days prior to the completion date while the task remains outstanding.

The scope of Stairwell's latest SOC 2 audit included all systems used to deliver the Stairwell platform.

Stairwell requires that user entities: * Determine whether Stairwell's security infrastructure is appropriate for their needs and for notifying Stairwell of any requested modifications. * Request Stairwell to configure their Stairwell platform password characteristics. * Notify Stairwell of any user accounts that need to be added or removed due to employee termination or transfer of job responsibilities. * Immediately notify Stairwell of any actual or suspected information security breaches, including compromised user accounts, and/or confidential information.

Stairwell uses Google Cloud for cloud hosting services of the Stairwell platform. Google Cloud is responsible for: * The uptime, management and logical security of the infrastructure that supports the delivery of virtualized environments and network connectivity. * Providing physical security controls, all administration of their hardware equipment, and for reporting any logical or physical security incidents.