Compliance Center
Your comprehensive resource for understanding our certifications, regulatory compliance, and commitment to industry-leading security standards.
Industry Certifications
We maintain the highest standards through rigorous third-party audits and certifications.
ISO 27001:2022
Information Security Management System
Our ISMS is certified to the latest ISO 27001:2022 standard, demonstrating our commitment to systematic management of sensitive company and customer information.
SOC 2 Type II
Trust Service Criteria
Annual SOC 2 Type II audits verify our controls for security, availability, processing integrity, confidentiality, and privacy over an extended period.
NIST Cybersecurity Framework
CSF 2.0 Implementation
Our security program is aligned with NIST CSF 2.0, implementing comprehensive controls across Identify, Protect, Detect, Respond, Recover, and Govern functions.
CMMC Level 2
Cybersecurity Maturity Model Certification
We are actively pursuing CMMC Level 2 certification to serve Department of Defense contractors and handle Controlled Unclassified Information (CUI).
Regulatory Compliance
We maintain compliance with applicable federal, state, and international regulations.
GDPR
General Data Protection Regulation
Compliant- Data subject rights honored
- Privacy by design implemented
- DPA available upon request
CCPA/CPRA
California Consumer Privacy Act
Compliant- Consumer rights supported
- Opt-out mechanisms in place
- Annual risk assessments
HIPAA
Health Insurance Portability & Accountability
BA Ready- Business Associate Agreements
- PHI safeguards implemented
- Security risk analysis
PCI DSS
Payment Card Industry Data Security
Compliant- Secure payment handling
- Quarterly vulnerability scans
- Annual SAQ completion
GLBA
Gramm-Leach-Bliley Act
Ready- Safeguards Rule compliance
- Financial data protection
- Risk management program
State Privacy Laws
Multi-State Compliance
Compliant- Virginia VCDPA
- Colorado CPA
- Connecticut CTDPA
Security Controls & Frameworks
Our security program implements controls from multiple recognized frameworks.
CIS Critical Security Controls
We implement the Center for Internet Security's prioritized set of actions to protect organizations from the most pervasive cyber attacks.
MITRE ATT&CK Coverage
Our detection capabilities are mapped to the MITRE ATT&CK framework for comprehensive threat coverage.
Trust Center
Access compliance documentation and request security assessments.
Documentation
Request access to our compliance documentation, including SOC 2 reports, penetration test summaries, and security questionnaire responses.
Request Documents →Security Assessments
Request a security assessment or vendor risk questionnaire completion. We support SIG, CAIQ, HECVAT, and custom questionnaires.
Request Assessment →Agreements
Access our standard Data Processing Agreement (DPA), Business Associate Agreement (BAA), and other contractual documents.
Request Agreement →Status Page
Monitor real-time system status, scheduled maintenance, and historical uptime metrics for all Syntrix Security services.
View Status →Compliance Questions
Common questions about our compliance program.
How can I obtain a copy of your SOC 2 report?
SOC 2 reports are available under NDA. Please contact our compliance team at compliance@syntrixsecurity.com to request a copy.
Do you sign Business Associate Agreements?
Yes, we provide BAAs for customers who require HIPAA compliance. Our standard BAA is available upon request.
Where is my data stored?
All customer data is stored in SOC 2 certified data centers located within the United States. We use Cloudflare for CDN and edge services.
How often are penetration tests conducted?
We conduct third-party penetration tests annually, with additional testing after significant changes. Executive summaries are available upon request.
What security questionnaires do you support?
We support SIG, SIG Lite, CAIQ, HECVAT, VSAQ, and custom questionnaires. Typical turnaround is 5-7 business days.
How do you handle security incidents?
We have a documented incident response plan with 24/7 monitoring. Customers are notified of confirmed incidents affecting their data within 72 hours.
Need Compliance Assistance?
Our compliance team is ready to help with your security and regulatory requirements.