SOC2 Compliance & Data Governance
Enterprise-grade security and compliance built into every layer of the Exertia platform.
Compliance Overview
Certified since 2025
Annual third-party audits covering security, availability, and confidentiality trust service criteria
In Progress
Information security management system certification expected Q1 2027
Compliant
Full compliance with EU General Data Protection Regulation for international clients
Supported
Automated reporting for LEED v4.1, Energy Star, and local carbon output regulations
Security Architecture
Defense-in-depth security across every layer of the platform.
Encryption at Rest
AES-256 encryption for all stored telemetry data, account information, and configuration files. Encryption keys managed via AWS KMS with automatic rotation.
Encryption in Transit
TLS 1.3 for all API communications, MQTT broker connections, and dashboard traffic. Certificate pinning for mobile and IoT clients.
Access Control
Role-based access control (RBAC) with principle of least privilege. Multi-factor authentication (MFA) required for all administrative access.
Network Security
VPC isolation, WAF protection, DDoS mitigation, and network segmentation between telemetry ingestion, processing, and storage layers.
Audit Logging
Immutable audit logs for all data access, configuration changes, and AI model deployments. Logs retained for 7 years with tamper-evident hashing.
Incident Response
Documented incident response plan with <4 hour response time for critical security events. Regular tabletop exercises and penetration testing.
Data Governance Framework
Data Classification
All data is classified into four tiers: Public, Internal, Confidential, and Restricted. Building telemetry is classified as Confidential. Personal data is classified as Restricted.
Data Lifecycle
Automated policies govern data from ingestion through archival and deletion. Real-time data is compressed after 30 days, archived after 12 months, and purged after retention expiry.
Access Governance
Quarterly access reviews for all personnel with system access. Automated deprovisioning for terminated employees. Privileged access management (PAM) for infrastructure.
Vendor Management
All sub-processors undergo security assessment before onboarding. Annual reviews of cloud provider compliance certifications. Data Processing Agreements (DPAs) with all vendors.
Certifications & Audits
Annual Penetration Testing
Independent third-party penetration testing conducted annually by certified ethical hackers. All findings remediated within 30 days.
SOC2 Type II Audit
Annual independent audit covering security, availability, and confidentiality trust service criteria. Reports available under NDA for Enterprise customers.
Business Continuity
Documented BCP/DR plan with <4 hour RTO and <1 hour RPO. Regular disaster recovery testing with automated failover across availability zones.
Contact for Compliance
For compliance inquiries, security reports, or to request SOC2 audit documentation, contact compliance@exertiasystems.com or call our security team directly.