Everything your risk team is going to ask us for
Certifications, data residency, subprocessors, penetration tests and incident response. Published, not negotiated over email.
Service status
Section 01 · Certifications
Certifications and compliance
SOC 2 Type II · ISO 27001
Xpectra runs on Google Cloud, whose infrastructure is audited for SOC 2 Type II and certified ISO/IEC 27001. On top, our own controls: TLS 1.3, AES-256, bcrypt and tokenized cards.
infrastructure · Google Cloud
GDPR
Data processing agreement, standard contractual clauses and impact assessment available.
DPA · SCCs · DPIA
Data residency
Choose your region at implementation: European Union or United States. Data does not leave it.
europe-west1 · us-east4
Uptime SLA
99.9% contractual with service credit. Historical record published on the status page.
99.98% · trailing 90 d
Performance and accuracy figures shown on this site are measured in controlled test environments on representative datasets. Real results vary with data quality, list configuration and volume. The only binding commitments are those stated in the service agreement.
Section 02 · Controls
Our controls, on certified infrastructure
Google Cloud provides the certified infrastructure (SOC 2 Type II, ISO/IEC 27001). Each line below is a platform control with its concrete value.
- Encryption in transit
- TLS 1.3
- Encryption at rest
- AES-256
- Authentication
- SSO · SAML · SCIM
- Internal access
- least privilege
- Audit log
- immutable · 7 yr
- Penetration testing
- annual · third party
- Incident response
- 24 h notification
- Backups
- RPO 15 min · RTO 4 h
- Subprocessors
- published list
- Staff training
- AML & security, annual
Section 03 · Diligence
Vendor diligence pack
Request the full pack| Document | Format | Access |
|---|---|---|
| Google Cloud SOC 2 Type II & ISO 27001 attestations | under NDA | |
| Penetration test summary | under NDA | |
| Data processing agreement | PDF · DOCX | direct download |
| Subprocessor list | web page | public |
| Business continuity & recovery plan | under NDA | |
| Security questionnaire (CAIQ) | XLSX | direct download |
Deepcode LLC returns completed vendor questionnaires within five business days.