Hacktron has achieved SOC 2 Type 1 compliance. The report and documentation of relevant controls are on our trust center.

Because we build security software, we hold ourselves to the same standards we expect from every vendor we trust. Hacktron is built on dogfooding: we run our own product to surface vulnerabilities early and often. SOC 2 compliance is external validation of that discipline.

What SOC 2 Type 1 covers

SOC 2 is a security audit standard for companies that handle customer data. A third-party auditor checks the company’s controls against a set of trust services criteria.

Hacktron has achieved this based on the Security trust services criteria, which require us to commit to, among other things:

• System features and configuration settings designed to authorize user access while restricting unauthorized users from accessing information not needed for their role.

• Use of intrusion detection systems to prevent and identify potential security attacks from users outside the boundaries of the system.

• Regular vulnerability scans over the system and network, and penetration tests over the production environment.

• Operational procedures for managing security incidents and breaches, including notification procedures.

• Use of encryption technologies to protect customer data both at rest and in transit.

• Data retention and disposal.

How Hacktron secures Hacktron

We use our own products to test for vulnerabilities throughout our software development lifecycle: the platform for continuous scanning in the CI/CD pipeline, and the CLI for internal penetration testing every quarter. The report covers the quarterly scans:

What this means for our customers

An independent third-party firm audited us, which lets us work better with customers who require SOC 2 compliance or are otherwise interested in our security posture.

Thanks to Insight Assurance, which ran the audit, and to Vanta for its platform and support.