Veracross LLC

Veracross LLC is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.

Yes. Veracross LLC's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Veracross LLC hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Security isn't a single yes/no, but Veracross LLC is SOC 2 Type II compliant and holds SOC 2 Type II, PCI DSS, GDPR, CCPA, HIPAA. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Veracross LLC hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@veracross.com or via a /security page (Veracross LLC lists a security contact).

Veracross LLC lists 50 subprocessors on its trust center, including Amazon Web Services, Microsoft Azure, Salesforce, Atlassian, Vanta. Buyers use this for fourth-party risk review.

Veracross LLC hosts on AWS, Azure. Data residency details are on its trust center.

Veracross LLC's trust center is at https://trust.veracross.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Veracross employs advanced monitoring of the dark web using a tool called Recorded Future which automatically scans and collects data from dark web sources. This information is used to identify potential threats, such as leaked credentials or sensitive company information. When compromised credentials are detected, these high priority alerts are automatically routed to our internal IT team who then take the necessary steps to mitigate the risk. With the ability of Recorded Future to proactively detect potential threats, it allows us to take preventative measures like password resets or account lockouts before a bad actor can utilize these credentials in a malicious manner. By staying vigilant and proactive, Veracross is actively mitigating the risk of unauthorized access and potential data breaches, ensuring a higher level of security.

Veracross maintains datacenters in the US, Germany, Australia, and the Netherlands. In most cases, Veracross stores customer data in the geography closest to the customer.

Veracross takes data privacy & security seriously. You can read our support article here, outlining our commitments to our community. You can also look at the Controls we maintain and check out other FAQs.

Veracross has comprehensive backup and retention policies to ensure the security and availability of customer data. Veracross continuously backs up customer data in multiple redundant locations, with daily backups available for a rolling 30-day window and monthly backups available for one year. These backups are stored at both AWS and Azure, ensuring data is encrypted and secure. Veracross has procedures in place to guide the secure retention and disposal of both company and customer data. These procedures ensure that data is retained and disposed of according to compliance and regulatory requirements. For our services, Veracross does not own customer data, therefore data retention is controlled by our customers. Should a customer leave Veracross, we will provide the customer with their data in a portable format within 30 days of termination and then delete their data. All departing customer data will be automatically deleted from our backups within 90 days. Veracross maintains a disaster recovery plan that includes the ability to recreate infrastructure in a different cloud region, maintaining a Recovery Point Objective (RPO) of 15 minutes or less and a Recovery Time Objective (RTO) of 4 hours or less. This plan ensures that Veracross can respond and recover promptly in the event of a disaster.

Customer data is protected by TLS 1.2+ encryption when in-flight and AES-256 encryption when at rest.

Veracross maintains an Incident Response Team (IRT) made up of technical, security, and management personnel. The incident response plan follows several high-level phases, including: - Event assessment - Breach assessment & containment - Reporting - Post-breach activities

Veracross utilizes a dedicated Security Operations Center (SOC) to monitor 24x7x365. Additionally, Veracross also has the following security measures in place: - Web Application Firewalls - Distributed Denial of Service (DDoS) mitigation - File Integrity Monitoring (FIM) - Intrusion detection systems (IDS)

Veracross maintains sufficient cybersecurity insurance to protect ourselves and our customers in the event of an incident.

Veracross utilizes cloud providers to assist with a timely response and recovery in the event of a disaster. Our disaster recovery plan consists of multiple parts, including but not limited to the items below. - Customer data is backed up continuously in a redundant location - Daily backups are available for a rolling 30-day window and monthly backups are available for one year - Maintaining a Recovery Point Objective (RPO) of 15 minutes or less and a Recovery Time Objective (RTO) of 4 hours or less - Backups are stored at both AWS and Azure - Encrypted database backups stored on a separate cloud provider - Ability to re-create the infrastructure in a different cloud region Note: No customer data is stored on-premises.

Veracross has both a Website Privacy Policy and a [Product Privacy Policy]( https://www.veracross.com/veracross-product-privacy-policy/).

Veracross has historical uptimes >99.99%. This applies to Veracross’s database servers, the Axiom application, and the Portals application. Note: Downtime does not include scheduled maintenance and emergency maintenance.

Veracross performs security assessments on all third-party vendors before any data is exchanged. This process includes questions surrounding the company's security policies, procedures, controls, and compliance with any applicable industry standards, and focuses on identifying any potential vulnerabilities or gaps.