Snapshot 86902
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Trust Center Security built for your environment. Elastio examines supported source copies without modifying their contents. Pursuit installs no agent on the inspected host. Connector, analysis, and integration permissions depend on the deployment; this page explains how to review that architecture and our security program. Security DocsSupport portal SOC 2 ReportRequest under NDA Security Teamsecurity@elastio.com Architecture review Review the processing path for your deployment. Managed Hunt shares data with an Elastio service account for analysis. Private-cloud Hunt runs analysis infrastructure in the customer account. Review source data, extracted artifacts, findings, metadata, and Pursuit model inputs as distinct data flows. Agree processing location, retention, access controls, model endpoint, and subprocessor terms during the security review. Request the deployment-specific architecture and assurance documents through the access process below. Operating model Security Program Internal security controls. End-to-end controls across identity, infrastructure, development, detection, and compliance. Identity and Access SSO enforced. Phishing-resistant FIDO2 MFA required. IAM roles and short-lived tokens for cloud access. Just-in-time production access with no standing privileges. Zero-trust network access for remote connections. Cloud Architecture Production runs as immutable infrastructure managed through IaC. All configuration changes undergo automated security checks and approval. Unauthorized changes auto-detected and escalated. Secure Development Lifecycle Automated secret scanning, SAST, DAST, and container image scanning on every build. Mandatory peer review. Security design reviews for new features. Threat modeling integrated into engineering. Logging, Detection, and Response SIEM ingests telemetry from corporate, development, and production environments. Detections routed to on-call engineers via paging. Global security team for triage and remediation. Vulnerability Management Continuous scanning across infrastructure and dependencies. Severity-based remediation SLAs. Critical findings resolved before release. Annual third-party penetration test. Supplier Risk All vendors handling customer data assessed before onboarding. Subprocessor list maintained. DPA terms available for regulated environments. Annual review cycle for critical suppliers. Audits and Compliance Annual SOC 2 Type II audit covering security, availability, and confidentiality. AWS-validated Security and Storage Competencies. All audit reports available to customers on request. Encryption and Key Management TLS 1.2+ in transit. AES-256 at rest. AWS KMS and Azure Key Vault for key management. CMK supported. Automated controls prevent keys from being stored through unapproved channels. Certifications Current certifications and attestations. Third-party validated security posture across cloud and enterprise standards. SOC 2 Type II StatusCurrent Security, Availability, Confidentiality · Annual · Platform and internal operations · Report available under NDA Request Report AWS Security Competency StatusVerified AWS-validated security proficiency · Publicly verifiable on APN View on APN AWS Storage Competency StatusVerified AWS-validated storage expertise · Publicly verifiable on APN View on APN AWS Well-Architected Review StatusCompleted Security, reliability, operational excellence, performance, cost · Publicly verifiable on APN View on APN Documentation Available to customers and evaluators. Full platform security documentation accessible via the support portal. Evaluators provisioned within one business day. Platform Security documentation Full documentation available in the support portal. Verified customers access directly. Evaluators and prospects request access below, provisioned within one business day. Platform architecture and data flow Incident response plan and timelines Access control model and IAM policies Subprocessor list and DPA Encryption standards and key management SOC 2 / NIST CSF / ISO 27001 mapping Vulnerability management SLAs Penetration test report (NDA) Open Support Portal Request Access Disclosure & Contact Security team. Responsible disclosure, vendor questionnaires, and direct security contact. Vulnerability Disclosure Report a security vulnerability in the Elastio platform. Include: description, reproduction steps, and potential impact. Acknowledgment within 24 hours, remediation timeline within 72 hours. No public bug bounty program. security@elastio.com Vendor Reviews and Questionnaires Security questionnaires, pen test authorization requests, audit support, and documentation not covered by the portal. CAIQ, SIG Lite, and custom formats supported. Standard turnaround 5 business days. security@elastio.com Security Review Need documentation for your security review? Request the SOC 2 report, security questionnaire, or a direct call with the security team. Reach us at security@elastio.comor through the contact form. Contact Security Team Security Docs