Question 1

Is Truepic SOC 2 compliant?

Accepted Answer

Truepic is SOC 2 Type II compliant. On SOC2C this listing is Listed.

Question 2

Is Truepic ISO 27001 certified?

Accepted Answer

According to Truepic's public trust center, Truepic is ISO 27001 certified. On SOC2C this listing is Listed.

Question 3

Is Truepic GDPR compliant?

Accepted Answer

According to Truepic's public trust center, Truepic is GDPR compliant. On SOC2C this listing is Listed.

Question 4

Is Truepic CCPA compliant?

Accepted Answer

According to Truepic's public trust center, Truepic is CCPA compliant. On SOC2C this listing is Listed.

Question 5

Is Truepic SOC 2 Type I or Type II?

Accepted Answer

Truepic is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Question 6

Can I use Truepic's SOC 2 for a vendor risk assessment?

Accepted Answer

Yes. Truepic's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Question 7

Is Truepic penetration tested?

Accepted Answer

Truepic hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Question 8

Does Truepic have an ISO 27001 certificate?

Accepted Answer

Truepic publishes an ISO certificate on its trust center; you can request access through SOC2C.

Question 9

Can I get Truepic's SOC 2 report?

Accepted Answer

Truepic's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Question 10

Is Truepic secure?

Accepted Answer

Security isn't a single yes/no, but Truepic is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR, CCPA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Question 11

Does Truepic have a bug bounty or vulnerability disclosure program?

Accepted Answer

Truepic hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@truepic.com or via a /security page (Truepic lists a security contact).

Question 12

Who are Truepic's subprocessors?

Accepted Answer

Truepic lists 9 subprocessors on its trust center, including Amazon Web Services, Google APIs, Slack, TimeScaleDB, Datadog. Buyers use this for fourth-party risk review.

Question 13

Where does Truepic host or store data?

Accepted Answer

Truepic hosts on AWS, and handles Customer personally identifiable information, Credit card information, Personal health information, Pictures and videos. Data residency details are on its trust center.

Question 14

Where is Truepic's trust center or security page?

Accepted Answer

Truepic's trust center is at https://trust.truepic.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Truepic

About

Compliance & infrastructure

Documents

Subprocessors

Compliance leadership

Penetration test

This listing is partial

Frequently asked

Technology peers that completed SOC 2

Action1

ELJUN LLC

equipifi

IntelligentSystems Corp