Is ThingLink About secure?

Security isn't a single yes/no, but ThingLink About is SOC 2 compliant and holds ISO 27001, GDPR. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Does ThingLink About have a bug bounty or vulnerability disclosure program?

ThingLink About hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@thinglink.com or via a /security page (ThingLink About lists a security contact).

Who are ThingLink About's subprocessors?

ThingLink About lists 15 subprocessors on its trust center, including Amazon Web Services, Google Workspace, Fastly, Inc. , Cloudflare, Inc., ZenDesk, Inc.. Buyers use this for fourth-party risk review.

Where is ThingLink About's trust center or security page?

ThingLink About's trust center is at https://trust.thinglink.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Is this your company? Buyers are checking ThingLink About here. Claim thinglink.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.

Claim free

ThingLink About

Q: Where does ThingLink About host or store data?

ThingLink About hosts on AWS, and handles Customer personally identifiable information, Credit card information, Personal health information, Limited personally identifiable information within specified categories: https://trust.thinglink.com/faq?s=khw1p69v3kmezvkd2dtc7. Data residency details are on its trust center.

thinglink.com · United States· 1–50 employees· Security contact

Security overview Compliance Penetration test

Trust level

Listed

Unverified

Listed

Domain

Report

Live

Sourced from public information. Not yet verified by the company.

ThingLink About is SOC 2 compliant. ThingLink About also holds ISO 27001, and GDPR.

Request report access Claim this profile

Framework

SOC 2

Auditor

Not publicAdd

Last report

—Add

Renewal

UnknownAdd

View official trust center ↗

About

As an ISO 27001 certified organization, we adhere to the most stringent international standards for managing and securing your data. This reflects our dedication to implementing robust security measures, ensuring the confidentiality, integrity, and availability of all information we handle. You can also request additional documents as needed. ThingLink is also GDPR, COPPA, and FERPA compliant. We are always happy to answer questions about how your data is handled, your local laws, and any other concerns so that you can feel confident about using ThingLink in the classroom, workplace, or any ot

Compliance & infrastructure

ISO 27001 GDPR

Hosting

AWS

Data handled

Customer personally identifiable informationCredit card informationPersonal health informationLimited personally identifiable information within specified categories: https://trust.thinglink.com/faq?s=khw1p69v3kmezvkd2dtc7

Subprocessors

A
Amazon Web Services · Cloud provider
G
Google Workspace · Identity provider
F
Fastly, Inc.
C
Cloudflare, Inc.
Z
ZenDesk, Inc.
G
Google Analytics
M
Mixpanel, Inc.
H
HubSpot, Inc.
M
Mailgun Technologies, Inc.
S
Stripe, Inc.
R
Recrea Systems, SLU (Quaderno)
C
Churn Buster, LLC

Show all 15 subprocessors

L
Lantirn, Inc. (Ronin)
P
Paypal, Inc.
Z
ZoomInfo Technologies LLC

Compliance leadership

The person who leads ThingLink About's SOC 2 isn't listed yet. Claim this profile to add it.

Penetration test

Unknown. ThingLink About's penetration test vendor isn't listed yet.

Claim this profile to add it.

This listing is partial

6/11 details · 55%

SOC2C shows the verified essentials. 5 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.

Auditorraises trust
Add the CPA firm that issued your SOC 2 so buyers can verify who signed it.
Report dateraises trust
Add your most recent report period so buyers see how current your SOC 2 is.
Renewal date
Add your renewal window so buyers know your coverage is active.
Documents
List the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
Security controls
Confirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.

Claim free to control your listing

Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.

Frequently asked

Is ThingLink About SOC 2 compliant?

ThingLink About is SOC 2 compliant. On SOC2C this listing is Listed.

Is ThingLink About ISO 27001 certified?

According to ThingLink About's public trust center, ThingLink About is ISO 27001 certified. On SOC2C this listing is Listed.

Is ThingLink About GDPR compliant?

According to ThingLink About's public trust center, ThingLink About is GDPR compliant. On SOC2C this listing is Listed.

Can I use ThingLink About's SOC 2 for a vendor risk assessment?

Yes. ThingLink About's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Is ThingLink About penetration tested?

ThingLink About hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Show 5 more questions

Answers published by ThingLink About

Reproduced from ThingLink About's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗

Where is the data stored?

ThingLink main data storage is located in Ireland via Microsoft Azure and Amazon Web Services (AWS) cloud servers. Some data we share with our subprocessors is stored outside of the European Union, including the US. You can review our subprocessors at thinglink.com/subprocessors If you are using ThingLink for an educational institution, please note that ThingLink acts as a data processor and the institution is the data controller.

What kind of personal data is collected?

For registered users, we collect the following kinds of data: - account information (username, email address, date of birth for students) - user’s content - payment information - communications with ThingLink staff - data from third-party accounts (Google, Microsoft, Facebook accounts) if you choose to sign up with them - communications between users (EDU accounts only) - Technical activity log (IP address, interaction with the system) For those who simply view ThingLinks on thinglink.com, we proccess: - IP address, user agent, preferred language. We process IP addresses to serve content and combine this data with other information to differentiate user sessions, but we do not store IP addresses on their own & cannot link them to a person. - Anonymous data about the user’s flow through the system

Does ThingLink meet any international security standards?

Yes, ThingLink is ISO 27001 certified, ensuring that we meet international standards for information security management. You can review the certificate here.

Does ThingLink collect data via embedded content?

We collect the viewer’s IP address, user agent (browser information) and anonymous statistics about viewers’ interaction with the content. The first two are required to optimize content delivery. However, if the ThingLink embed contains any other third-party embeds (e.g. YouTube videos), they may collect additional data and place their own cookies.

Does ThingLink share customer data with third parties?

Yes, some data (including PII) is shared with our subprocessors: - our hosting and content delivery providers - web analytic services (do not receive PII) - our payment processor (not applicable to schools or invoiced customers) - helpdesk and sales communication tools (receive some PII when a user contacts us) You can review our subprocessors at thinglink.com/subprocessors When we disclose your information to our subprocessors, we do so under the same conditions upon which you share your data with us and limit their use of your data to the sole purpose of assisting us with providing the ThingLink service. Apart from our subprocessors, ThingLink does not disclose your Personal Data to third parties unless, 1. you have provided us with your express opt-in consent for doing so; 2. the disclosure is reasonably necessary for us to be able to enforce our Terms of Service; 3. the disclosure is reasonably necessary for the purposes of detecting and preventing fraud or security breaches, or applicable law requires us to disclose it. We may share aggregate and anonymized User Data (provided that it does not contain any Personal Data) to select third parties.

How long does ThingLink retain user data?

For individual accounts, the data is stored until the user’s account is deleted. Technical activity logs are stored for 90 days, or 30 days if the user’s account is deleted. For organizational (i.e. corporate, school, or university) accounts, all data is retained as long as ThingLink is providing the service. If any personal data becomes outdated or should be removed for some other reason while the contract lasts, the organization's admin user can delete or modify it via the user interface.

What technical and other security measures are in place?

All data is encrypted in transit, and sensitive data is encrypted at rest. Backups are configured to run weekly on in-scope systems, and a backup restore test is performed at least annually to validate the backup data and backup process. Access to customer data is role-based. Only select employees can access customer data for the purposes of providing the service or customer support. All employees undergo regular privacy and security trainings. ThingLink utilizes automated intrusion detection systems and carries out regular security reviews.

Who can I contact if I have further questions?

If you have any further security or privacy-related questions, please submit a support request or send an email to your ThingLink point of contact.

What models and services power ThingLink AI features, what data do they receive, and how is that data processed?

You can find more information in our support article.

Is student data publicly accessible?

No, as long as students use student accounts their data is available to: - ThingLink staff - Their teachers - Other students belonging to the same teacher/school (this can be disabled via organization settings). The only exception is student content - students can choose to make their content available to anyone with a link. See below.

Can students make their content publicly available?

Students can create unlisted content that can be viewed by anyone who has access to the link. However, such content won't appear on Google or other search engines unless the content is posted on a publicly available page. You can learn more about different content privacy settings here.

Can I modify or delete my or my students' data?

Yes, most data can be modified without contacting ThingLink staff. Furthermore, users can delete their account which will lead to immediate termination of their data, with the exception of logs which will be purged 30 days after the account is deleted. Most of your data can be accessed or changed via Account settings.

Show 7 more questions

Education peers that completed SOC 2

Compare vs Go1 Compare vs Mentor Collective Compare vs Practera