UltraOffice Trust Center
Trust Center
Everything you need for a security review, including compliance status, controls, and documentation. Click any card for detail.
Overview
Welcome to the UltraOffice Trust Center. Data privacy and security are embedded in every part of how we build and run the product. Use this page to review our security posture, see our compliance status, and request our documentation.
Prospective customers can click "Get access" below to request SOC 2 reports, the Data Processing Agreement, and questionnaire responses under NDA.
Compliance
Subprocessors
Subprocessors
Full list with data-processing details: /security/subprocessors
Documents
Data Processing Agreement
- Signed DPA available for enterprise customers under NDA.
- Standard Contractual Clauses included for EU data transfers.
- Subprocessor list and change-notification terms attached.
View more (1) →
Documents
- SOC 2 Type I report: available under NDA (issued June 2026).
- Data Processing Agreement (DPA).
- Security brief / whitepaper.
View more (4) →
Product Security
Encryption Standards
- Encryption in transit: TLS 1.2+ on every external endpoint (TLS 1.3 preferred where supported).
- Encryption at rest: AES-256 via GCP KMS, AWS KMS, or tenant-managed keys.
- Postgres: provider-managed disk encryption.
View more (3) →
Data Residency
- SaaS default: us-central1 (Iowa).
- BYOC: customer's choice of region and cloud provider.
- No data replication outside the chosen region unless the customer explicitly configures cross-region backup.
View more (1) →
No-Training Commitment
- Zero-retention / no-training headers are set on every LLM API request by default.
- Provider terms (Anthropic, OpenAI, Google, AWS) prohibit using customer API traffic to train foundation models.
- UltraOffice does not train, fine-tune, or retain customer data for model development.
View more (1) →
Product Security
- Customer documents classified Restricted end-to-end.
- Per-team Google Cloud Storage buckets and KMS keys.
- Row-level security on every multi-tenant Postgres table.
View more (2) →
AI Usage
- LLM providers: Anthropic, OpenAI, Google Vertex AI, AWS Bedrock.
- Zero data retention for model training under each provider's API terms.
- Customer content is never used to train any foundation model.
View more (2) →
Data Security
- Encryption in transit: TLS 1.2+ on every external endpoint.
- Encryption at rest: AES-256 via GCP KMS.
- Per-tenant encryption keys, not a single shared key.
View more (2) →
Controls
Access Control
- MFA enforced on Google Workspace, GCP, and GitHub.
- Role-based access control with least-privilege defaults.
- Quarterly access reviews across every in-scope system.
View more (2) →
Endpoint Security
- Full-disk encryption required on every employee laptop.
- Screen lock and auto-update enforced via acceptable-use policy.
- Anti-malware and firewall enabled on all endpoints.
View more (1) →
Corporate Security
- Background checks for all personnel with production access.
- Confidentiality obligations signed at hire.
- Acceptable-use policy acknowledged annually.
View more (1) →
Asset Management
- Laptop inventory tracked with owner and assignment date.
- Production systems and subprocessors inventoried in a central register.
- Data classified into Public, Internal, Confidential, and Restricted tiers.
View more (1) →
Training
- Security awareness training at onboarding and annually thereafter.
- Role-based training for engineers with production access.
- Phishing-recognition drills during the year.
View more (1) →
Change Management
- Every production change ships through a peer-reviewed pull request.
- No direct pushes to `main`; branch protection enforced.
- Automated tests and CI gates required before merge.
View more (1) →
Business Continuity & DR
- Automated daily backups of Postgres via Cloud SQL point-in-time recovery.
- GCS object versioning enabled on customer data buckets.
- Tier-1 RTO 4 hours, RPO 1 hour.
View more (1) →
Vulnerability Management
- Dependabot and pip-audit on every pull request.
- Secret scanning (TruffleHog) blocks commits containing credentials.
- Critical vulnerabilities patched within 7 days; High within 30.
View more (1) →
Incident Response
- Documented IR plan with severity tiers, roles, and escalation paths.
- 24/7 alerting via Sentry and GCP uptime checks.
- Customer notification within contractually-committed windows.
View more (1) →
Network Security
- All external traffic over TLS 1.2+.
- Cloud Run services behind Google Front End with DDoS protection.
- Private VPC connectors for service-to-service traffic.
View more (1) →
Infrastructure
- Built on Google Cloud Platform (project `ultraoffice`, region `us-central1`).
- Compute Engine for services, GCS for documents, Cloud SQL for Postgres.
- Caddy on Compute Engine serves the frontend.
View more (1) →
Logging & Monitoring
- GCP Cloud Logging on every production service.
- Audit logs retained for 400 days; application logs for 30.
- Sentry for real-time error alerting.
View more (1) →
Physical & Environment
- Production compute and storage run in Google Cloud data centers.
- Physical security, power, cooling, and media disposal inherited from GCP.
- UltraOffice operates no on-premises production infrastructure.
View more (1) →
Vendor Management
- Every subprocessor reviewed before engagement and at least annually.
- Signed DPA or equivalent terms with every vendor handling customer data.
- SOC 2 report (or equivalent assurance) required for Tier-1 vendors.
View more (1) →
Self-Assessments
- CAIQ (Consensus Assessments Initiative Questionnaire): available under NDA.
- SIG Lite questionnaire: available under NDA.
- Annual internal risk assessment with documented register.
Legal & Policies
Vulnerability Disclosure
- Contact: security@ultraoffice.ai.
- Acknowledgment within 2 business days.
- Annual third-party penetration test; executive summary available under NDA.
View more (1) →
Policies
- Information Security Policy.
- Access Control Policy.
- Change Management Policy.
View more (10) →
Legal
- Terms of Service: ultraoffice.ai/legal/terms-conditions.
- Privacy Policy: ultraoffice.ai/legal/privacy-policy.
- Acceptable Use Policy: available on request.
View more (2) →
Data Privacy
- Customer content never used to train AI models.
- Customer data deleted within 30 days of account closure.
- Export available in standard formats on request.
View more (2) →
Knowledge Base
Knowledge Base (FAQ)
Is UltraOffice SOC 2 compliant?
UltraOffice is SOC 2 Type I certified (June 2026), with the Type II observation window now underway. Controls (infrastructure-level data isolation, AES-256 encryption, customer-managed keys, audit logging, quarterly access reviews) are already operating continuously and generating daily evidence.
9 more questions →