SOC 2 Type I
Audit in progressAn independent CPA firm’s audit of how our security controls are designed, measured against the AICPA Trust Services Criteria.
We share the report under NDA once it is issued.
Trust center
Security and compliance at VINify
Banks, credit unions and other regulated institutions review every vendor before they share data. This page shows where our independent assessments stand, the policies our security program runs on, and how to request a deeper review.
Status last updated
Independent assessments
Where do our assessments stand?
We report each assessment as it stands today, and we update this page when a report is issued.
SOC 2 Type II
Observation period in progressTests whether those controls work as designed over a period of months, not on a single day. The report follows the end of the observation period.
We share the report under NDA once it is issued.
KY3P third-party risk assessment
In progressAn independent assessment of our controls on KY3P, a third-party risk platform used in financial services vendor reviews.
Results are available to approved reviewers once complete.
Our policies are built on NIST Cybersecurity Framework and ISO 27001 principles, and our incident response is aligned with NIST SP 800-61. These are the frameworks we design to, not certifications.
How we protect your data
What protects client data at VINify?
Each practice below is set by a written policy listed further down this page.
Encryption
Client data is encrypted at rest with AES-256 and in transit with TLS 1.2 or higher. Encryption keys are managed in AWS Key Management Service and rotated at least once a year.
Access control
Multi-factor authentication is required for all staff access to our infrastructure, email and code. Access is granted only for a documented business need and reviewed every quarter for privileged and production systems.
Reviewed changes
Every code change needs approval from someone other than its author, and every production release needs approval from someone other than the person who started it. No one can bypass these checks, including administrators.
Continuous monitoring
Activity in our AWS environment is logged continuously and analyzed for threats around the clock. High-severity alerts go straight to our on-call lead, and AWS audit logs are kept for a year.
Resilient hosting
Production runs on AWS in the United States, with our database spread across multiple data centers and automatic failover. Backups are taken daily, encrypted, protected from changes and copied to a second U.S. region.
Vetted people
Everyone is background-checked, signs a confidentiality agreement and completes security training before getting access to any system. Training repeats every year.
Policies
What policies does our security program run on?
Every policy and plan below is written, approved by leadership and reviewed at least once a year. Open an area to see what each one covers.
Security governance
How security is owned, measured and kept accountable.4 documents
Information Security Policy
Sets one control environment for protecting client and company data, built on NIST Cybersecurity Framework and ISO 27001 principles. It covers encryption, access, devices, monitoring and incident handling.
Risk Assessment Policy and Risk Register
Defines how we identify, rate and treat business, security, vendor, compliance and fraud risk. Each risk is recorded with an owner and a treatment, and fraud risk is reviewed every quarter.
Code of Conduct and Disciplinary Process
Sets the standards of honest, lawful conduct for everyone who works at or with VINify, including confidentiality and conflicts of interest. A signed confidentiality agreement is required before any access.
Whistleblower Policy
Gives anyone working with VINify a protected way to report suspected fraud, unethical conduct or misuse of client data. Good-faith reports are protected from retaliation.
Data protection and privacy
What data we hold, how it is handled and when it is deleted.3 documents
Data Protection and Privacy Policy
Sets the technical and organizational controls that protect the data we collect, process and store, including personal information. It names a privacy owner and covers requests to access, correct or delete data.
Data Classification Policy and Record of Processing Activities
Sorts all information into four sensitivity tiers with handling rules for each. Data a client provides is treated as Restricted, our highest tier, by default.
Data Retention and Disposal Policy
Sets how long each type of data is kept and how it is destroyed when that period ends. When a client relationship ends, client data is returned or deleted under the contract.
Access and identity
Who can reach which systems, and how that is controlled.3 documents
Access Control Policy
Governs how access is granted, changed, reviewed and removed. Access follows least privilege, requires multi-factor authentication and is reviewed every quarter for privileged and production systems.
Acceptable Use Policy
Sets how company systems, devices and data may be used, including which AI tools are allowed and what data may never go into them. Everyone acknowledges it before receiving access and every year after.
Asset Management Policy
Defines how devices, cloud resources and software subscriptions are classified, assigned an owner, tracked in one register and retired.
Infrastructure and technical security
How our systems are protected and watched.4 documents
Encryption Policy
Sets approved encryption standards and key management rules: AES-256 for data at rest, TLS 1.2 or higher in transit, and regular key rotation.
Logging and Monitoring Policy
Defines what is logged, how long logs are kept, and how alerts are reviewed and escalated. Activity in our AWS environment is logged continuously and analyzed for threats.
Physical Security Policy
Covers the physical side of a remote company: data center controls inherited from AWS and checked against AWS’s independent SOC 2 report, plus encryption and secure disposal for our own devices.
Vulnerability Management Policy
Requires systems to be scanned or reviewed for vulnerabilities and findings fixed within set deadlines by severity. Nothing ships to production with an unresolved critical or high finding unless an exception is approved.
Secure development and change
How code moves from idea to production.2 documents
Secure Software Development Lifecycle (SDLC) Policy
Builds security into every stage of how we plan, build, test and release software, including automated code scanning before every merge and annual secure-coding training for developers.
Change Management Policy and Procedures
Requires every significant change to be documented, tested, approved and traceable. Code merges and production releases each need approval from a second person, and no one can bypass those checks.
Incident response and resilience
How we respond and recover when something goes wrong.5 documents
Incident Response Plan
Defines how we detect, classify, contain, investigate and report security incidents, aligned with NIST SP 800-61. It sets our client notification commitments and is tested at least once a year.
On-Call Team Policy
Makes sure someone is always available to respond to security alerts, with set response times by severity and recorded handovers.
Business Continuity Plan
Sets how we keep or restore critical operations through a cyber incident, a vendor outage or the absence of a key person. The plan is tested at least once a year.
Disaster Recovery Plan
Explains how we restore our AWS systems and client data after a disruption, with defined recovery objectives and recovery testing at least once a year.
Backup Policy
Sets how backups are made, protected and restored: taken daily, encrypted, and restore-tested at least once a year.
People and screening
Who we trust with access, and how we prepare them.2 documents
Employee Background Check Policy
Requires identity, criminal, education and employment checks before anyone receives access to any system or data.
Security Awareness Training Policy
Requires security and privacy training before access and every year after, plus secure-coding training for developers.
Vendors and third parties
How we choose and oversee the companies we rely on.1 document
Vendor Management Policy
Governs vendors from selection to offboarding. Each vendor is risk-rated and reviewed before onboarding, and our current subprocessor list is available to clients on request.
Full policy documents are confidential. We share them with approved reviewers under NDA as part of a security review.
Security reviews
Need more for your vendor review?
Tell us what your team needs. We review every request and reply by email.
What we can share under NDA
- Full policies and plans
- Answers to your security questionnaire
- Architecture and data flow overview
- SOC 2 reports, once issued
Report a security concern
Email security@getvinify.com. Please leave client data, passwords and personal information out of your report.
Current clients can also contact their Client Success Manager.
FAQ
Security questions we hear most
Is VINify SOC 2 certified?
SOC 2 isn’t a certification. It’s an audit report issued by an independent CPA firm. Our SOC 2 Type I audit and our Type II observation period are both in progress, and we share each report under NDA once it is issued.
Where is client data stored?
Production systems and client data are hosted on Amazon Web Services in the United States, with backup copies in a second U.S. region. Client data is encrypted at rest and in transit.
Does VINify put client data into AI tools?
No. VINify runs structured data lookups and rules-based analysis on client data, not generative AI. Our Acceptable Use Policy bars confidential, client and personal data from AI tools, and our AWS environment is opted out of AWS using our data to improve its AI services.
How would we hear about a security incident?
Our Incident Response Plan commits us to notify affected enterprise clients within 24 hours of detecting a suspected or confirmed incident involving their data. We email your security contact, call for high-severity incidents, and send a written summary once the incident is resolved. Your contract can set stricter terms.
Who are VINify’s subprocessors?
We share our current subprocessor list on request as part of a security review, and we give clients advance notice of changes.
Evaluating VINify for your portfolio?
Your security review and pilot planning can run side by side.
Talk to us about a pilot