As a Compliance Manager, you need to ensure any new vendor meets regulatory requirements and audit standards. Here's our compliance posture.
Compliance Frameworks
Standards Alignment
| Framework | Status | Documentation |
|---|---|---|
| SOC 2 Type II | Aligned practices | Available under NDA |
| GDPR | Compliant | DPA available |
| HIPAA | Capable | BAA available |
| CCPA | Compliant | Privacy policy |
| PCI DSS | N/A | No card data processed |
Audit Support
What We Provide
- Audit logs: Complete activity trail
- Access reports: Who accessed what, when
- Change history: Configuration modifications
- Data lineage: Where data flows
Retention Policies
- Audit logs: 7 years (configurable)
- Activity data: Customer-defined
- Export capability: Full data portability
Data Handling
Data Classification
- No PII storage: We process, not store sensitive data
- Encryption: AES-256 at rest, TLS 1.3 in transit
- Data residency: US-based (multi-region available)
- Data deletion: On request, verifiable
Third-Party Processors
| Vendor | Purpose | Compliance |
|---|---|---|
| AWS | Infrastructure | SOC 2, ISO 27001 |
| Anthropic | AI processing | SOC 2 |
| Stripe | Payments | PCI DSS L1 |
Process Controls
Built-in Compliance Features
- Segregation of duties: Role-based access
- Approval workflows: Multi-level authorization
- Exception handling: Documented and tracked
- Training records: User certification tracking
Regulatory Reporting
- Automated compliance reports
- Exception dashboards
- SLA tracking
- Incident documentation
Vendor Assessment
Documents Available
- Security questionnaire responses
- SOC 2 attestation letter
- Penetration test summary (NDA required)
- Insurance certificates
- Business continuity plan overview
Identifying Compliance Transformation Opportunities
When reviewing a company's audit findings, compliance reports, or risk assessments, look for these signals that indicate S2T can help:
Compliance Signals → S2T Solutions
| If Documents Mention... | S2T Addresses This With... |
|---|---|
| "Audit findings" or "control gaps" | Automated controls with audit trails |
| "Documentation deficiencies" | Every action logged automatically |
| "Segregation of duties issues" | Role-based access with enforced separation |
| "Process deviation" or "policy violations" | Enforced workflows prevent deviation |
| "Manual controls" or "detective controls" | Preventive controls built into workflows |
| "Evidence collection" or "audit prep" | Ready-to-export compliance reports |
| "Third-party risk" or "vendor management" | SOC 2 aligned, full security documentation |
| "Training documentation" or "attestation" | User certification tracking built-in |
Compliance Questions to Explore
- Which processes have the most audit findings or control gaps?
- Where does manual evidence collection consume the most time?
- What compliance frameworks drive the highest documentation burden?
- Which controls are detective rather than preventive?
Request Compliance Documentation
Get the materials you need for vendor assessment.
Schedule Review Contact Compliance