Is AskVault SOC 2 compliant? Our current SOC 2 position
The honest answer
AskVault is not SOC 2 certified. We do not have an AskVault-owned SOC 2 audit report, and we will not hand you a letter that implies otherwise.
What we can say is where your data lives. Documents, indexed text, embeddings and conversations are stored with a managed database provider that holds a SOC 2 Type II report and encrypts storage with AES-256. That report covers the provider's infrastructure, not AskVault's own application, team or processes.
What SOC 2 Type II means
SOC 2 is an audit framework for how a service company protects customer data. A Type II report says an independent auditor checked that the company's controls worked over a period, usually 6 to 12 months (about 180 to 365 days), rather than on a single day. Buyers ask for it because it saves them from auditing each vendor themselves.
What the provider report covers, and what it does not
The split is simple: infrastructure belongs to the provider, everything above it is ours.
| Covered by the database provider's report | Not covered, because it is AskVault's own responsibility |
|---|---|
| Physical and cloud security of the database | How AskVault's application scopes queries to your workspace |
| Encryption of stored data at rest | Who on the AskVault team can access production |
| The provider's backups and infrastructure operations | AskVault's code review, deployment and incident processes |
The security overview describes the AskVault side in plain terms: workspace-scoped queries, hashed API keys, encrypted channel secrets, and HTTPS with an HSTS policy of 365 days. Every workspace is isolated the same way, from 1 workspace on Free to 15 workspaces on Business.
What to send your security reviewer
- This page and the security overview, so the reviewer sees the real position rather than a badge.
- The provider list, which names the services that handle your data. It is available on request from [email protected].
- The Data Processing Agreement, available on request — email [email protected].
- A questionnaire, if you have one. Email it to [email protected] and we will answer each question directly, including the ones where the answer is "not yet".
What we do not have yet
- No AskVault-owned SOC 2 or ISO 27001 report.
- No independent penetration test. See penetration testing.
- No bug bounty.
- No BAA, so no protected health information. See HIPAA.
- No EU data residency; data is stored in one US region.
FAQ
Is AskVault SOC 2 Type II certified?
No. The SOC 2 Type II report belongs to our database provider, not to AskVault.
Can I get a SOC 2 report?
There is no AskVault report. You can request the database provider's report from that provider.
Is PCI-DSS relevant?
AskVault does not process card payments. Our merchant of record, Dodo Payments, handles checkout.
Is there a bug bounty?
No. Report issues to [email protected].