Security and Privacy at Venture360.
Security is at the heart of what we do. Helping our clients improve their security and compliance starts with our own.
SOC 2 Type II
Certified
24/7
Endpoint Monitoring
AES-256
Data Encryption
Governance
Governance
Venture360's Security and Privacy teams establish policies and controls, monitor compliance with those controls, and prove our security and compliance to third-party auditors.
Security Principles
- Access limited to legitimate business need, principle of least privilege
- Security controls layered per defense-in-depth
- Controls applied consistently across enterprise
- Implementation iterative, continuously maturing
Compliance
Venture360 maintains a SOC 2 Type II attestation. Our SOC 2 Type II report is available on our Trust Center. Venture360 maintains compliance with SOC for Service Organizations.
Data Protection
Data at rest
All datastores are encrypted. Sensitive data is protected with field-level encryption to ensure maximum security even in the event of unauthorized access to storage systems.
Data in transit
All data in transit is encrypted using TLS 1.2 or higher. HSTS is enforced across all endpoints. Certificates are managed through AWS ALB with automatic renewal.
Secret management
Cryptographic keys are managed through AWS KMS with hardware security modules (HSMs). Application secrets are stored in AWS Secrets Manager and Parameter Store with automatic rotation.
Vulnerability Management & Testing
Penetration testing
Third-party security auditors regularly verify our controls through comprehensive penetration testing of our infrastructure and applications.
Vulnerability scanning
We employ a multi-layered scanning approach to identify and remediate vulnerabilities across our entire stack.
- Static application security testing (SAST)
- Software composition analysis (SCA)
- Malicious dependency scanning
- Dynamic application security testing (DAST)
- Network vulnerability scanning
- External attack surface management (EASM)
Endpoint Security & Access Management
Endpoint protection
Central device management with MDM, anti-malware, and 24/7/365 monitoring ensures all endpoints meet our security baseline.
Secure remote access
Remote access is secured through Tailscale (WireGuard-based) with malware-blocking DNS to protect against threats at the network level.
Security education
Comprehensive security training on onboarding and annually, including live sessions, secure coding sessions, and threat briefings for all team members.
Identity and access management
Identity is managed through Okta with phishing-resistant WebAuthn authentication. Role-based access controls are enforced with automatic deprovisioning when team members leave.
Vendor security
We take a risk-based approach to vendor security, evaluating each vendor based on data access, production integration, and potential brand impact.
Questions about our security?
Our security team is happy to discuss our practices and provide additional documentation for your review.