# Ethyca

Privacy compliance automated

To grow your business, you need to prove your customers can trust you with their data.

Ethyca simplifies trust - so you can focus on business.

## Compliance

SOC 2 Type II

## Resources

### Compliance Reports

[SOC 2 Type 2 Audit Report](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=698229b915109230e095b6a5)

### Penetration Test Report

[Penetration Test Executive Summary](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=6735d6c718905aca5bbf5bf9)

### Information Security Policies

[Information Security Policy and Acceptable Use Policy](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=65ea663f6af50d8aa7bb6530)  
[Access Control Policy](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=65ea663f6af50d8aa7bb6531)  
[Asset Management Policy](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=65ea663f6af50d8aa7bb6532)  
[Business Continuity and Disaster Recovery Plan](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=65ea663f6af50d8aa7bb6533)

### Other resources

[Code of Conduct](https://trust.ethyca.com/?requestAccessOpen=true&requestedResources=6a3bf546021af4ce48cf6266)

## Controls

Updated 30 minutes ago

[**Infrastructure security**](https://trust.ethyca.com/controls#infrastructure-security)

- Infrastructure performance monitored  
- Network and system hardening standards maintained  
- Log management utilized

[**Organizational security**](https://trust.ethyca.com/controls#organizational-security)

- Employee background checks performed  
- Employee Handbook acknowledged by employees  
- Data retention procedures established

[**Product security**](https://trust.ethyca.com/controls#product-security)

- Control self-assessments conducted  
- Penetration testing performed

[**Internal security procedures**](https://trust.ethyca.com/controls#internal-security-procedures)

- SOC 2 - System Description  
- Organization structure documented  
- Roles and responsibilities specified

[**Data and privacy**](https://trust.ethyca.com/controls#data-and-privacy)

- Data classification policy established  
- Customer data deleted upon leaving

## Subprocessors

Amazon Web Services

Public cloud hosting provider

USA  
[https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf](https://d1.awsstatic.com/legal/aws-dpa/aws-dpa.pdf)

Twilio SendGrid

Transactional email service provider

USA  
[https://www.twilio.com/en-us/legal/data-protection-addendum](https://www.twilio.com/en-us/legal/data-protection-addendum)

Ethyca’s latest SOC 2 Type 2 audit report. Our examination period ends on October 31st each year, with the new report typically available by the following January. Executive summary of Ethyca’s most recent pen test. For a detailed walkthrough of the full report, please reach out to us at security@ethyca.com - we’d be happy to meet and discuss. Vanta connects to a company's core systems to continuously monitor these controls.