Is Subsplash penetration tested?

Subsplash hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Subsplash is SOC 2 compliant and holds PCI DSS, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does Subsplash have a bug bounty or vulnerability disclosure program?

Subsplash hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@subsplash.com or via a /security page.

Who are Subsplash's subprocessors?

Subsplash lists 13 subprocessors on its trust center, including Amazon Web Services, Salesforce, Snowflake, Intercom, Stripe. Buyers use this for fourth-party risk review.

Where is Subsplash's trust center or security page?

Subsplash's trust center is at https://trust.subsplash.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking Subsplash here. Claim subsplash.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

Subsplash

Q: Where does Subsplash host or store data?

Subsplash hosts on AWS, and handles Customer personally identifiable information, Employee personally identifiable information, Credit card information, Personal health information. Data residency details are on its trust center.

subsplash.com · United States· 51–200 employees

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

Subsplash is SOC 2 compliant. Subsplash also holds PCI DSS, GDPR, and CCPA.

Request report access Claim this profile

Framework

SOC 2

Auditor

Not publicAdd

Last report

—Add

Renewal

UnknownAdd

View official trust center ↗

About

Trusted by over 20,000 churches around the the world, the Subsplash Platform is built with the highest level of security to keep you and your community safe.

Compliance & infrastructure

PCI DSS GDPRCCPA

Hosting

AWS

Data handled

Customer personally identifiable informationEmployee personally identifiable informationCredit card informationPersonal health information

Subprocessors

A
Amazon Web Services · Hosting, storage and processing Customer Data
USA
S
Salesforce · Support and account management
USA
S
Snowflake · Data warehouse services
USA
I
Intercom · Support and account management
USA
S
Stripe · Payment processing
USA
O
Outreach · Customer Communication Tool
USA
H
Hubspot · CRM Integration
USA
T
Tableau · Data Visualization Platform
USA
L
Loom · Support Recordings
USA
M
MongoDB · Database Hosting
USA
P
Pendo · Data analytics
USA
S
Sentry (Functional Software, Inc. d/b/a Sentry) · Application Monitoring
USA

Show all 13 subprocessors

S
Slack · Customer Support and Internal Communication
USA

Compliance leadership

The person who leads Subsplash's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. Subsplash's penetration test vendor isn't listed yet.

Claim this profile to add it.

Recent updates

Subsplash Renews EU-US Data Privacy Framework MembershipJan 2025

Subsplash has renewed our membership in the Data Privacy Framework (DPF) program. This participation allows personal data to freely flow to the United States from the European Union, United Kingdom, and Switzerland without the need to enter into additional transfer terms such as the Standard Contractual Clauses (SCCs). To participate in the DPF program, Subsplash completed its self-certification to the International Trade Administration of the US Department of Commerce via the Department's DPF program website and publicly committed itself as an organization to comply with the DPF Principles of notice, choice, security, data integrity and purpose limitation, access, recourse and enforcement, and accountability for onward transfers. Subsplash's participation in the DPF program reinforces our dedication to GDPR-driven privacy and data protection principles. You may find Subsplash’s listing on the DPF website here and refer to the details outlined in the EU-US, UK Extension To The EU-US, Swiss-US Data Privacy Framework in our updated Privacy Policy.

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is Subsplash SOC 2 compliant?

Subsplash is SOC 2 compliant. On SOC2C this listing is Listed.

Is Subsplash PCI DSS compliant?

According to Subsplash's public trust center, Subsplash is PCI DSS compliant. On SOC2C this listing is Listed.

Is Subsplash GDPR compliant?

According to Subsplash's public trust center, Subsplash is GDPR compliant. On SOC2C this listing is Listed.

Is Subsplash CCPA compliant?

According to Subsplash's public trust center, Subsplash is CCPA compliant. On SOC2C this listing is Listed.

Can I use Subsplash's SOC 2 for a vendor risk assessment?

Yes. Subsplash's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Show 6 more questions

Answers published by Subsplash

Reproduced from Subsplash's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Where can I find information about Subsplash's uptime and downtime?

We recommend checking out our Status Page. This will give you the ability to subscribe for updates, view uptimes, be informed of any outages, and view historical data.

Do you encrypt data at rest?

All datastores with customer data, in addition to S3 buckets, are encrypted at rest. Sensitive collections and tables also use row-level encryption. This means the data is encrypted even before it hits the database so that neither physical access, nor logical access to the database, is enough to read the most sensitive information.

Do you encrypt data in transit?

Subsplash uses TLS 1.2 or higher everywhere data is transmitted over potentially insecure networks. We also use features such as HSTS (HTTP Strict Transport Security) to maximize the security of our data in transit. Server TLS keys and certificates are managed by AWS and deployed via Application Load Balancers.

How do I report a security vulnerability?

We run an ongoing bounty program through Bugcrowd to provide penetration testing across all of our products on the Subsplash Platform. These security researchers are some of the best in the world at finding vulnerabilities and responsibly disclosing them. Our bounty program is open to anyone who finds a security vulnerability. (To report a vulnerability, please request an invite to our program by contacting us at security@subsplash.com)

Business & Industrial peers that completed SOC 2

Compare vs Newsworthy.ai Compare vs Octopus Deploy Compare vs 1099-Prep