Is this your company? Buyers are checking Badge Group here. Claim trybadge.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Badge Group
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Badge Group is SOC 2 Type II compliant.
About
Badge is a SaaS platform that helps brands and platforms drive customer engagement through mobile wallet passes on Apple and Google Wallet. Our software allows businesses to easily create, distribute, and update digital passes that live in a customer's native wallet app, enabling push notifications, location-based messaging, and dynamic content updates without the need for a mobile app. We offer APIs, SDKs, and white-label tools to support both brands and enterprise platforms, with use cases ranging from loyalty cards and coupons to event passes and membership cards.
Compliance & infrastructure
Hosting
GCP
Subprocessors
7- DDatadog · Cloud monitoringUSA
- GGoogle Cloud Platform · Cloud providerUSA
- HHeap · Data analyticsUSA
- IIntercom · Customer supportUSA
- GGoogle Analytics · Data analyticsUSA
- RReadme · Data AnalyticsUSA
- SSvix Inc. · Webhook ManagmentUSA
Compliance leadership
The person who leads Badge Group's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Badge Group's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
5/11 details · 45%SOC2C shows the verified essentials. 6 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Badge Group SOC 2 compliant?
Badge Group is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Badge Group SOC 2 Type I or Type II?
Badge Group is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Badge Group's SOC 2 for a vendor risk assessment?
Yes. Badge Group's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Badge Group penetration tested?
Badge Group hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Badge Group secure?
Security isn't a single yes/no, but Badge Group is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Badge Group have a bug bounty or vulnerability disclosure program?
Badge Group hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@trybadge.com or via a /security page.
Who are Badge Group's subprocessors?
Badge Group lists 7 subprocessors on its trust center, including Datadog, Google Cloud Platform, Heap, Intercom, Google Analytics. Buyers use this for fourth-party risk review.
Where does Badge Group host or store data?
Badge Group hosts on GCP. Data residency details are on its trust center.
Where is Badge Group's trust center or security page?
Badge Group's trust center is at https://trust.trybadge.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Badge Group
Reproduced from Badge Group's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
Please describe the services that are being offered.
Badge is a SaaS platform that helps brands and platforms drive customer engagement through mobile wallet passes on Apple and Google Wallet. Our software allows businesses to easily create, distribute, and update digital passes that live in a customer's native wallet app, enabling push notifications, location-based messaging, and dynamic content updates without the need for a mobile app. We offer APIs, SDKs, and white-label tools to support both brands and enterprise platforms, with use cases ranging from loyalty cards and coupons to event passes and membership cards.
What sort of data do users enter into the application?
By default, Badge does not collect any Personally Identifiable Information (PII). However, customers have the option to collect PII from their end users (e.g., name, email, phone number) when issuing mobile wallet passes, such as through custom sign-up forms, the Badge API, or third-party integrations (e.g., loyalty platforms, POS systems, or CDPs). Badge follows strict data governance practices to ensure customer and end-user data is securely stored and processed in compliance with applicable privacy regulations.
What technologies are utilized in the scope of the application?
The Badge platform uses the latest common technologies: - Frontend: React is our primary frontend framework. We also utilize a selection of UI frameworks based on the specific use case. - Backend: Our Node.js with TypeScript stack includes tRPC, Express, and Prisma. - Database: Data is stored using Postgres managed with Google Cloud SQL. - Infrastructure: Our entire infrastructure is hosted on Google Cloud Platform (GCP).
Do you have an on-premise or private cloud solution?
Badge is only offered as a Software-as-a-Service (SaaS). Badge is hosted on Google Cloud (GCP) via a virtual private cloud (VPC).
How do you segregate customers?
The Badge platform is run on our own dedicated, virtual private cloud within Google Cloud (GCP). While data is in a multi-tenant environment, we have several levels of logical separation at the application level and multiple layers of unit testing, integration testing, and functional testing to ensure proper controls are in place. Customer data is securely separated via logical separation.
Where is customer data stored
Badge is Software-as-a-Service hosted on Google Cloud (GCP). Data is stored in multiple datastores on GCP infrastructure located in the United States of America. Data is backed up daily in each region and the backups are also stored within GCP infrastructure. Failover is achieved through distribution of the system in multiple GCP regions and availability zones, which are geographically disjoint data centers.
Do you collect geolocation data?
Badge does not actively collect, store, or process any real-time geolocation data from users. Instead, we include pre-defined location metadata (e.g., GPS coordinates for a store location) in the pass itself. Apple and Google Wallet use that metadata to determine when the user is within the designated geofenced areas. Apple and Goole handle all location tracking on-device. Both Apple and Google require users to opt-in to location-based services at the device and wallet app level. Customers can opt out at any time via their phone's settings. This experience is fully compliant with both Apple and Google's privacy standards and terms/conditions.
Do you encrypt all data in transit and at rest?
All data is protected as if it is highly sensitive. All network traffic in and out of our data facility is encrypted with TLS 1.2. All data is encrypted at rest using 256-bit Advanced Encryption Standard (AES-256).
How do you manage access to production systems?
Access to production systems is given based on the principle of least privilege. We have multiple levels of access control, which is broken out by role and responsibility. Employees must request further access through our ticketing process and explain why a higher level of privilege is needed. Two-factor authentication is required for access to infrastructure and code repositories. We regularly review access controls during security reviews and during the onboarding/offboarding of employees. If an employee no longer requires a higher level of access or changes roles within the organization, their permission level is reviewed and adjusted based on the needs of the role accordingly.
Do staff have access to customer data?
Certain Badge employees may have access to your data in order to service your account. It is our policy to only access your data under your request to provide support and to resolve issues. Employees at Badge with access to customer data have the least privilege possible.
What third-party vendors / sub-processors do you use?
Badge uses third-party vendors to help support the services that we provide. The list of third-parties that may receive customer data can be accessed in the Subprocessor section of our Trust Center. Third parties receiving and processing data only do so in accordance with delivering licensed services. No third-party service leveraged by Badge claims ownership or seeks to own the data we send to them.
How do you secure user accounts?
We require users to authenticate with a code sent to their email address when logging in to the platform. Failure to enter the correct code will result in brute force lockout after a set number of invalid attempts. Optionally, users can enable MFA using an authenticator app.
Technology peers that completed SOC 2
Action1
action1.com · United States · Technology
SOC 2 Type IIRenewal not public
ELJUN LLC
eljunllc.com · United States · Technology
SOC 2 Type IIRenewal not public
equipifi
equipifi.com · United States · Technology
SOC 2 Type IIRenewal not public
IntelligentSystems Corp
hyperbound.ai · United States · Technology
SOC 2 Type IRenewal not public