Encryption
AES-256 at rest, TLS 1.3 in transit. Per-family encryption keys for cryptographic isolation.
Full details →
← Back to Trust Center
Compliance Center
Security & Compliance Overview
Everything your compliance team needs for vendor due diligence — policies, controls, and documentation in one place.
Last updated: March 2026
Compliance Posture
SOC 2 Type II report issuedAudited by an independent firm and pen tested by a third party. Reports available upon request under NDA.
In Place
- 17 Security Policies Adopted
- SOC 2 Type II Report Issued
- Independent Penetration Test Completed
- AES-256 Encryption (at rest & in transit)
- SOC 2 Audited Hosting Infrastructure
- Formal Governance Structure
Available upon request under NDA
- SOC 2 Type II Report
- Penetration Test Summary
- Security Policy Documents
- Subprocessor List
Security Controls & Policies
17 policies adopted across six categories. Policy documents are available upon request.
Information Security
- Information Security PolicyRequest Access
- Data Classification PolicyRequest Access
- Encryption PolicyRequest Access
- Data Retention & Disposal PolicyRequest Access
Access & Personnel
- Access Control PolicyRequest Access
- Personnel Security PolicyRequest Access
Infrastructure & Network
- Network Security PolicyRequest Access
- System Configuration & Hardening PolicyRequest Access
Risk & Incident Management
- Risk Assessment PolicyRequest Access
- Incident Response PolicyRequest Access
Operations & Change
- Change Management PolicyRequest Access
- Business Continuity PolicyRequest Access
- Disaster Recovery PolicyRequest Access
Governance
- Acceptable Use PolicyRequest Access
- Vendor Management PolicyRequest Access
- Privacy PolicyView
- Code of ConductRequest Access
Security Architecture
Data Residency
All data processed and stored exclusively in the United States on SOC 2 audited infrastructure.
Full details →Access Control
Role-based access control, mandatory MFA, per-family isolation boundaries. All access logged.
Full details →Monitoring
Continuous monitoring with automated threat detection, anomaly detection, and 24/7 incident response.
Full details →Frequently Asked Questions
What is your SOC 2 status?
entropyFA has completed its SOC 2 Type II audit. The report was issued by an independent auditor, and the platform runs on SOC 2 Type II certified cloud infrastructure. Our 17 security policies are aligned to the SOC 2 Trust Services Criteria. The report is available upon request under NDA.
Has entropyFA completed penetration testing?
Yes. An independent security firm has completed a penetration test of the platform, and every finding was remediated or formally documented. A summary of the results is available upon request under NDA.
What is the breach notification timeline?
72 hours from confirmation of a security incident involving client data. This is a contractual commitment in our Data Confidentiality Agreement, Section 6.
How is data isolated between clients?
Per-family data isolation with dedicated access boundaries and per-family encryption keys. Data is never commingled across households in queries, processing, or storage.
Can I get a list of subprocessors?
Yes. A current list of subprocessors is available upon request. Contact support@entropyfa.com.
Need additional documentation?
Additional compliance materials — including policy documents, penetration test results, and subprocessor lists — are available under NDA.