Wicket

Yes. Wicket's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.

Wicket hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.

Wicket's SOC 2 report is available on request. Request access through SOC2C and we coordinate the company-side NDA and delivery.

Wicket publishes an ISO certificate on its trust center; you can request access through SOC2C.

Security isn't a single yes/no, but Wicket is SOC 2 Type II compliant and holds SOC 2 Type II, ISO 27001, GDPR, NIST CSF. SOC2C verifies its compliance posture and shows how strongly each fact is proven.

Wicket hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@wicketsoft.com or via a /security page (Wicket lists a security contact).

Wicket's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.

Wicket's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.

Wicket's trust center is at https://trust.wicketsoft.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.

Wicket has maintained a formal Information Security (InfoSec) Program since 2019 that consists of a managed cloud services provider, automated security compliance software, managed detection and response (MDR) services for vulnerability remediation, static code analysis tools, security benchmarking tools, and various other procedures and documentation that support a robust defense in depth. Two separate audit firms have independently audited Wicket’s platform, and we continue annual audits against multiple security frameworks. Our SOC2 Type 2 attestation report demonstrates our compliance with the security, availability, and confidentiality standards set by the American Institute of Certified Public Accountants (AICPA) as well as the core subcategories of the NIST Cybersecurity Framework. Wicket’s Information Security Management System (ISMS) received initial ISO 27001 certification in April 2023 and undergoes surveillance audits each year until re-certification. In addition, we achieved GDPR compliance in June 2023. Refer to the Resources section in this Trust Center for artifacts related to these third party audits.

The individual registration process for our Access product is designed to ensure compliance with privacy laws such as BIPA. When an individual is opting-in to Wicket (as in the case of a fan and facial ticketing, or a guest or employee for access control), a series of informative web pages take the user through the benefits of opting-in, the policy detailing our client’s or Wicket’s biometric data practices, and the terms and conditions that apply in the process of securing written consent. This process can be configured to accommodate any unique aspects of the venue’s use case. Once consent is obtained, a secure link is provided, which only allows the upload of a current photo taken through the user’s device camera. By removing the ability to upload a pre-existing photo, Wicket avoids the possibility of uploading someone’s photo without their permission. Once uploaded, an algorithm evaluates the photo for approval and checks for elements such as size, clarity, lighting, multiple faces, and filters. This ensures that all reasonable precautions are taken to upload only those images that meet the highest standards. The system securely uploads photos of individuals to encrypted cloud storage, where they remain for the duration of their use. Wicket creates an embedding of each source photo, a 3D mathematical representation of the image, and sends these series of numbers to the edge devices for use during the authentication process. Each time an individual interacts with the system, the process repeats. The individual’s photo is turned into an embedding, which is compared to the source embeddings to decide if there is a match. For additional considerations around consent and ensuring compliance with BIPA and other privacy laws, please refer to the Wicket Privacy Policy: https://wicketsoft.com/privacy-policy.

PII is only used when necessary for the stated use of the product, and Wicket makes all efforts to minimize exposure and protect user data at all times. PII is never given, transferred, or otherwise utilized for any purpose other than the expressly stated use of the Wicket product. Wicket never sells any PII. All PII (i.e., name and email address) are securely stored in the cloud at all times. All edge devices use unique identifiers to link mathematical facial representations with their associated profiles. This provides the highest level of security on the edge device. Software platforms that we are integrated with to enable various use cases, such as ticketing and credentialing, provide specific data points that we store to execute each application. These include first name, last name, email address, account ID, and customer name ID. For Wicket Access, all PII is provided by the customer or user (after informed consent) and is encrypted in the cloud at all times while in the Wicket environment.

The short answer is “no”. To address the concerns about persons who have not expressly opted into Wicket Access, Wicket has implemented a number of controls to ensure that unconsented images are not captured or stored. Wicket ensures that all authentication solutions (access control, ticketing, payments, etc.) are equipped with identification zone technology that allows for the implementation of front, rear, and side boundaries to be configured so that only the person making an access attempt is targeted in the frame. Additionally, edge devices for these solutions perform real-time analytics such that matched images are securely sent to the cloud server, and background or passive images are deleted. All images retained as part of access decisions are purged from the system per the client’s or Wicket’s terms and conditions, whichever retention policy is shorter in duration.

Users can easily opt out at any time by emailing us at access-optout@wicketsoft.com. Once consent is withdrawn, relevant images and information are purged.

The Wicket team has taken steps in the design and implementation of our solution to maintain customer privacy and security: - All data is encrypted at industry standard levels both at rest and in transit. Wicket sets up encrypted cloud storage for our client’s images, and analysis of the faces is executed based on a numeric representation of the face - not the source photo itself. This improves security as Wicket does not use images on the edge; - In all product cases, all of the decisions and analyses are made locally (i.e., edge-decision) on the device as opposed to sending data back and forth to a cloud server (i.e., cloud-decision). This helps to minimize the possibility of information being intercepted; - While some competitors' systems rely on a constant flow of data between the camera and a cloud server to make decisions, the Wicket systems are designed to “Match on Device.” Beyond the improved speed and efficiency of this architecture, it also minimizes the amount of data that is flowing back and forth, thus limiting exposure. Additionally, it means that the system can continue to function as expected in the event of a loss of internet connection. Wicket does not use, transfer, or sell images or other personal information it collects for any other purpose, including any law enforcement purpose unless allowed or required by law. Additionally, none of the Wicket solutions use external means to identify unmatched faces. All matching is done within the system based on photos provided by the user or the client after consent has been secured; - None of the Wicket software products record video, nor are they designed to be used as a “live viewer” in the way typical CCTV systems are set up. Because no video is recorded, it can't be viewed or shared.

The Wicket algorithm enhancements were developed entirely in-house by our team of scientists based in Cambridge, MA, and we prioritized the need to address the issue of bias. With our Wicket technology, match or verification is done based on a set of data points converted to a unique identifier and is not based on matching a picture. For this reason, performance is limited only by the quality of the source video or images, which are based on a) pose or which way the person is looking, b) occlusion or facial hair, hats, glasses, or masks, and c) illumination or lighting. Therefore, efficacy and accuracy are not dependent upon age, skin tone, gender, etc.