Staq

According to Staq's public trust center, Staq is ISO 27018 certified. On SOC2C this listing is Listed.

Staq is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Staq's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Staq hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Staq is SOC 2 Type II compliant and holds GDPR, ISO 27001, PCI DSS, SOC 2 Type II, ISO 27017, ISO 27018. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Staq hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@staq.io or via a /security page (Staq lists a security contact).

Staq's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Staq's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Staq's trust center is at https://trust.staq.io. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Our platform can be deployed in a location of your choosing, be that cloud (eg AWS) or on-premise. Our dev environment is currently located on cloud with AWS with data residency options across the world.

Our banking and business partners are the data controllers of end-user data. Staq operates as a data processor on a limited basis. Staq's platform is compliant with data privacy laws such as GDPR, enabling our partners to manage end-user data in a compliant manner. Where required by local laws, Staq signs a Data Processing Agreement (DPA) with its partners to govern the processing of end-user data.

As a key outsourcing provider of regulated financial services entities, Staq is fully aware of the outsourcing rules now in place across most jurisdictions. Staq works closely with its partners to ensure full compliance with outsourcing rules. As an example, Staq's Master Service Agreement has been design with compliance in mind, seeking to address all of the common contractual requirements present in the outsource rules, which can of course be tailored to local specificities.

Staq is not a licensed financial services entity. We are a technology and business solutions company which partners with licensed financial services entities to offer Banking-as-a-Service and Embedded Finance solutions.

Staq engages third-party consultants to periodically audit its information security management systems.

Our platform ensures end-to-end encryption for data in transit using industry-standard security mechanisms. We enforce TLS 1.2 or higher for all data transmitted over potentially insecure networks, ensuring strong encryption standards. Our API endpoints use certificate-based authentication and TLS encryption, with HTTP Strict Transport Security (HSTS) enabled to enhance security. Secure site-to-site tunnels are established with robust encryption mechanisms to protect sensitive data. For cloud environments, server TLS keys and certificates are managed by AWS or GCP and deployed via Application Load Balancers. On-premise deployments follow the same encryption standards using our secure infrastructure.

Our platform ensures robust security by encrypting all data at rest across cloud and on-premise environments. Whether hosted on AWS, GCP, or using Longhorn for on-premise storage, we apply strong encryption standards to safeguard sensitive information, maintaining trust and compliance. - AWS: We use AWS Key Management Service (KMS) to encrypt data at rest in Amazon RDS, Amazon S3, and Amazon EBS. - GCP: We leverage Google Cloud’s default encryption for Cloud Storage, Cloud SQL, and Persistent Disks, with options for Customer-Managed Encryption Keys (CMEK). - On-Premise (Longhorn): We use Longhorn’s built-in encryption feature to secure persistent volumes, ensuring that all stored data remains encrypted.