Softtop is SOC 2 Type II certified, confirming that security controls covering availability, confidentiality, and data integrity have been independently audited and verified by a third-party assessor. The certification is renewed annually and the current report is available to enterprise customers under NDA. SOC 2 Type II certification is the standard required by enterprise IT security teams for vendor approval in regulated industries and enterprise procurement processes.
Data encryption applies at every layer of the platform. All data in transit is encrypted using TLS 1.2 or higher. All data at rest — call recordings, transcripts, customer records, message logs — is encrypted using AES-256. Encryption keys are managed using a zero-knowledge key management system so Softtop personnel cannot access customer call or message content without explicit customer authorization and a formal access request process.
Zero-trust access architecture requires authentication and authorization for every access request regardless of network location. Single sign-on via Okta, Microsoft Entra, and Google Workspace integrates with existing enterprise identity providers. Multi-factor authentication is enforced for all admin account access. Role-based access controls limit platform permissions to the minimum required for each user's specific function within the organization.
Infrastructure is hosted in geographically redundant data centers with 24/7 physical security, biometric access controls, redundant power, and automated failover. Security monitoring runs continuously with automated threat detection and defined incident response playbooks. Vulnerability disclosure and penetration testing results are available to enterprise customers on request. Privacy policy compliance covers GDPR, CCPA, and applicable telecommunications privacy regulations in every market where Softtop operates.