Trust center

How we protect the data you trust us with.

We hold ourselves to the controls we help customers with. This page reads from the same Wardline tests our auditors look at, and updates every hour.

✓ 20 of 21 controls passing▲ 1 control being monitoredUpdated today

SOC 2 Type II period: Oct 1, 2025 – Sep 30, 2026
Report issued: Oct 28, 2026
ISO 27001 certified: Mar 14, 2025
Latest penetration test: August 2026

Controls

Control status by category

Each status is the latest result of an automated test or a dated review. “Monitoring” means a test has flagged something we're working on; we show it rather than hide it.

Infrastructure5/5

Production data encrypted at restPassing
Encryption in transit with TLS 1.2 or laterPassing
Production network segmented from corporatePassing
Encrypted backups restored and tested monthlyPassing
Infrastructure defined in code with peer reviewPassing

Access and identity4/4

Single sign-on and MFA for all employeesPassing
Quarterly access reviews for productionPassing
Access removed within one business day of departurePassing
Privileged access time-limited and approvedPassing

Application security3/4

Required code review before mergePassing
Dependency scanning on every buildPassing
Annual third-party penetration testPassing
Medium-severity findings fixed within 30 daysMonitoring

People and endpoints4/4

Security awareness training at hire and yearlyPassing
Background checks for new hires where lawfulPassing
Disk encryption on every company laptopPassing
Endpoint protection on every company laptopPassing

Operations and resilience4/4

Incident response plan tested every yearPassing
Business continuity plan with defined RTO and RPOPassing
Centralized logging with twelve-month retentionPassing
Vendor reviews for every critical subprocessorPassing

Documents

Reports and certificates

Our SOC 2 report is issued by an independent licensed CPA firm, and our ISO 27001 certificate by an accredited certification body. Reports are shared under NDA.

SOC 2 Type II report
Covers security, availability and confidentiality.
NDA
ISO 27001 certificate
Scope: the Wardline platform and the Richmond office.
PublicView the ISO 27001 certificate
Penetration test summary
Executive summary and remediation status.
NDA
Bridge letter
Covers the time since the last report period ended.
On request
Security policy overview
A summary of our 22 security policies.
PublicView the Security policy overview
Completed security questionnaire
A standard questionnaire, answered in full.
NDA

ISO 27001 certificate

Certificate: ISMS-4471-WL
Issued: Mar 14, 2025
Valid through: Mar 13, 2028
Issued by: An accredited certification body

Security policy overview

Information security and acceptable use
Access control and encryption
Incident response and business continuity
Vendor management and data retention

Reviewed and approved every year by our CTO and CISO.

Subprocessors

Who processes data for us

We give customers 30 days' notice before adding a subprocessor that handles customer data.

Subprocessors
Subprocessor	Purpose	Location	Data
Cirrova	Cloud hosting and storage	United States	All customer data
Altastack	Disaster recovery region	United States	Encrypted backups
Mailcrest Relay	Transactional email	United States	Names, email addresses
Tickbarrow	Customer support tickets	United States	Support conversations
Ledgerfin Billing	Subscription billing	United States	Billing contacts, invoices
Northvane Analytics	Product usage analytics	Ireland	Pseudonymous usage events

Request access

Request security documents

Customers and prospects can request our reports here. Our security team checks each request, usually within one business day.

Found a vulnerability? Email security@wardline.example. We reply within two business days and don't take legal action against good-faith research.