Sensiba LLP, a licensed CPA firm, performs Statisfy's SOC 2 audits under the AICPA framework. ISO 27001 v2022 certification is held against the 2022 revision of the standard. Compliance posture is monitored continuously rather than checked once a year.

SOC 2 Type II · ISO 27001 v2022 · GDPR · CPRA · HIPAA

Audited, not self attested.

Q: What security certifications does Statisfy hold?

Statisfy is SOC 2 Type II attested and ISO 27001 v2022 certified, and is GDPR, CPRA (formerly CCPA) and HIPAA compliant. Statisfy is also a member of the Cloud Security Alliance. Certifications are issued by third-party auditors on an annual cadence rather than self attested.

Q: What happens to our data if we stop using Statisfy?

Statisfy's Data Processing Addendum states that upon termination, Statisfy will delete or return all personal data within thirty days, unless retention is required by law. Rights of access, correction, deletion and portability are supported where applicable law provides them.

Q: Does Statisfy need full access to our email?

No. You can connect one inbox at a time, or forward from a group address with no OAuth grant at all. The broad mailbox permission most tools require is optional rather than a precondition of using the product, which matters for security teams that will not grant tenant-wide mail access.

Q: Is Statisfy HIPAA compliant?

Yes. Statisfy's controls are aligned to HIPAA for teams handling protected health information. Talk to us about a BAA if your deployment requires one.

Q: Can we review Statisfy's security policies before buying?

Yes. The Statisfy Trust Center publishes the control families and policy set, including the Information Security Policy, Access Control Policy, Incident Management Policy, Network Security Procedure, Business Continuity and Disaster Recovery Policy, and Risk Assessment and Management Policy. Full documents and audit reports are available on request through the Trust Center.

Statisfy is SOC 2 Type II attested and ISO 27001 v2022 certified, and is GDPR, CPRA and HIPAA compliant. The SOC 2 audit is performed by Sensiba LLP, a licensed CPA firm, and was issued with a clean opinion and no noted exceptions. Customer data is hosted on enterprise cloud infrastructure in the United States.

Visit the Trust Center Common security questions

Standards

What Statisfy holds, and what each one means

SOC 2 Type II

Attested

Audited by Sensiba LLP against the AICPA trust services criteria. Clean opinion, no noted exceptions.

ISO 27001 v2022

Certified

Certified against the 2022 revision of the standard for information security management systems.

GDPR

Compliant

Data processing addendum available, with return or deletion of personal data within 30 days of termination.

CPRA (formerly CCPA)

Compliant

California privacy rights supported, including access, correction, deletion and portability.

HIPAA

Compliant

Controls aligned to HIPAA for teams handling protected health information.

Cloud Security Alliance

Partner

Member of the Cloud Security Alliance, the body behind the CSA STAR assurance program.

The audits

Who audited us, when, and what they found

SOC 2 audits are performed by Sensiba LLP, a licensed CPA firm, under the framework developed by the American Institute of Certified Public Accountants. Both reports were issued with a clean opinion.

SOC 2 Type II
July 31, 2024

Statisfy completed a SOC 2 Type II audit performed by Sensiba LLP. A Type II report assesses whether controls were designed appropriately and operated effectively across a period, rather than at a single point in time. The report carried a clean opinion with no noted exceptions.
SOC 2 Type I
March 26, 2024

Statisfy completed a SOC 2 Type I audit, also performed by Sensiba LLP, assessing the design of controls at a point in time. It likewise carried a clean opinion with no noted exceptions.

The current report, and any audit completed since the dates above, is available under NDA through the Trust Center.

Scope

Trust services criteria covered

A SOC 2 report only means something if you know which criteria it covers. Statisfy's covers all five.

✓ Security
✓ Availability
✓ Processing integrity
✓ Confidentiality
✓ Privacy

A Type II report assesses whether controls operated effectively across a period of time, which is a materially stronger statement than a Type I, which only assesses their design at a single moment.

Data handling

What happens to your data

Hosting and region: Customer data is hosted on enterprise cloud infrastructure in the United States.
Inbox access is scoped by you: Connect one inbox at a time, or forward from a group address with no OAuth grant at all. The broad mailbox grant most tools require is optional here, not a precondition.
Return and deletion: Upon termination, Statisfy will delete or return all personal data within thirty days, unless retention is required by law. That is the wording in the DPA, not a summary of it.
Audited, not self attested: Certifications are issued by third-party auditors on an annual cadence. Statisfy does not self-certify its own compliance.
Explainable by design: Health scores and agent actions link to the evidence behind them, so what the system did and why is auditable rather than opaque.
Human approval on outbound: Customer-facing actions can require human approval before anything sends, so automation never removes the control point.

Full terms are in the Data Processing Addendum, the privacy policy and the terms of service.

Controls

Six control families, monitored continuously

Controls are monitored continuously rather than reviewed once a year at audit time. The live status of each is published in the Trust Center.

Product security

Production system user review, vulnerability remediation, incident situational awareness
Data security

Production database access restriction, identity validation, termination of employment
Network security

Limiting network connections, transmission confidentiality, anomalous behaviour detection
Application security

Approval of changes, secure system modification, conspicuous link to privacy notice
Endpoint security

Anti-malware, full device and container encryption, session lock
Corporate security

Code of business conduct, organizational structure, roles and responsibilities

Policies

The policy set, available on request

Security reviewers can request the full documents through the Trust Center. The named policies include:

✓ Information Security Policy
✓ Access Control Policy
✓ Incident Management Policy
✓ Network Security Procedure
✓ Business Continuity & Disaster Recovery Policy
✓ Risk Assessment & Management Policy

Request access in the Trust Center

FAQ

Security questions buyers actually ask

Is Statisfy SOC 2 compliant?

Yes. Statisfy is SOC 2 Type II attested. The audit was performed by Sensiba LLP against the AICPA trust services criteria covering security, availability, processing integrity, confidentiality and privacy, and the report was issued with a clean opinion and no noted exceptions. A SOC 2 Type II audit completed on July 31, 2024, following a Type I audit completed on March 26, 2024. Current reports are available under NDA through the Statisfy Trust Center.

What security certifications does Statisfy hold?

Where is Statisfy data hosted?

What happens to our data if we stop using Statisfy?

Does Statisfy need full access to our email?

Is Statisfy HIPAA compliant?

Can we review Statisfy's security policies before buying?

Who audits Statisfy?

Statisfy Trust Center

Live control status, the full policy set, subprocessor list and audit reports. Request access and a security reviewer can work through it without going via sales.

Visit the Trust Center