SOC 2 & Our Security Practices

OpsPing is not pursuing SOC 2 certification — at our scale the audit's cost buys our customers less than the control transparency below. No report exists and none is planned. What we offer instead: an in-depth, plain-language mapping of our actual practices to the five Trust Services Criteria, so your team can evaluate the controls themselves.

SOC 2 Type II

Independent audit of security, availability, and confidentiality controls over an observation period. Not pursued — the practices that such an audit would examine are documented criterion-by-criterion below.

Not pursuing

GDPR

Data Processing Agreement available. Data stored in AWS us-east-2. Right to erasure supported.

Aligned — In Progress

ISO 27001

Not on the roadmap. Our practices overlap substantially with Annex A controls — access control, cryptography, operations security, supplier relationships — documented below in SOC 2 terms.

Not on the roadmap

Trust Services Criteria

SOC 2 audits evaluate controls against five Trust Services Criteria (TSC). Here's how OpsPing addresses each:

Security

Information and systems are protected against unauthorized access, unauthorized disclosure, and damage. Concrete controls: hard multi-tenant isolation enforced at the data layer (every row carries a tenant id; cross-tenant access is denied by default, including for our own staff); zero standing access — support sees customer data only by explicit, revocable invitation, with every action written to the customer's own audit log; TOTP MFA with AES-256-GCM-encrypted secrets; per-team roles with a custom permission matrix; scoped API keys (read/write/delete/config) stored as SHA-256 lookups with bcrypt verification; rate limiting on authentication endpoints. See our Security page for encryption, network, and vulnerability-management detail.

Availability

Information and systems are available for operation and use. Key controls: automated daily PostgreSQL backups, process supervision with automatic restart on the application host, uptime and error monitoring with alerting to our own on-call rotation, incident response runbooks, and an external status page backed by the live public status API.

Confidentiality

Information designated as confidential is protected. Key controls: bcrypt password and API-key hashing, API key scoping (read/write/delete/config), per-team roles with a custom permission matrix, hard tenant isolation with zero standing access (staff cannot read customer data), TLS via Caddy, application-layer AES-256-GCM encryption for sensitive fields, and no plaintext secrets in code or config.

Processing Integrity

System processing is complete, valid, accurate, timely, and authorized. Key controls: alert deduplication (alias-based), input validation with Zod schemas on every endpoint, durable delayed and repeated notifications, and an append-only audit log recording every administrative action.

Privacy

Personal information is collected, used, retained, disclosed, and disposed of in conformity with our Privacy Policy. Key controls: data retention policies, right to deletion, data minimization (we only store what's needed for alerting), and no third-party data sharing.

Where We Stand

ItemStatus
Security controlsImplemented as described above and on our Security page; not independently audited
Auditor engagementNone — not planned
SOC 2 Type II reportNone — not planned

We'd rather show you the controls than promise you a certificate. If certification ever goes back on the roadmap, this page will say so with real dates.

Request Our Security Package

No SOC 2 report exists, and we do not plan to commission one. What we share instead — completed security questionnaire responses, our DPA, the subprocessor list, the criterion-by-criterion mapping above, and architecture overviews — is available under NDA where appropriate. Email [email protected].