Trust center

How we protect the data you trust us with.

We hold ourselves to the controls we help customers with. This page reads from the same Wardline tests our auditors look at, and updates every hour.

✓ 20 of 21 controls passing▲ 1 control being monitoredUpdated today

SOC 2 Type II period: Oct 1, 2025 – Sep 30, 2026
Report issued: Oct 28, 2026
ISO 27001 certified: Mar 14, 2025
Latest penetration test: August 2026

Controls

Control status by category

Each status is the latest result of an automated test or a dated review. “Monitoring” means a test has flagged something we're working on; we show it rather than hide it.

Infrastructure 5/5

Production data encrypted at rest Passing
Encryption in transit with TLS 1.2 or later Passing
Production network segmented from corporate Passing
Encrypted backups restored and tested monthly Passing
Infrastructure defined in code with peer review Passing

Access and identity 4/4

Single sign-on and MFA for all employees Passing
Quarterly access reviews for production Passing
Access removed within one business day of departure Passing
Privileged access time-limited and approved Passing

Application security 3/4

Required code review before merge Passing
Dependency scanning on every build Passing
Annual third-party penetration test Passing
Medium-severity findings fixed within 30 days Monitoring

People and endpoints 4/4

Security awareness training at hire and yearly Passing
Background checks for new hires where lawful Passing
Disk encryption on every company laptop Passing
Endpoint protection on every company laptop Passing

Operations and resilience 4/4

Incident response plan tested every year Passing
Business continuity plan with defined RTO and RPO Passing
Centralized logging with twelve-month retention Passing
Vendor reviews for every critical subprocessor Passing

Documents

Reports and certificates

Our SOC 2 report is issued by an independent licensed CPA firm, and our ISO 27001 certificate by an accredited certification body. Reports are shared under NDA.

SOC 2 Type II report

Covers security, availability and confidentiality.

NDA
ISO 27001 certificate

Scope: the Wardline platform and the Richmond office.

PublicView the ISO 27001 certificate
Penetration test summary

Executive summary and remediation status.

NDA
Bridge letter

Covers the time since the last report period ended.

On request
Security policy overview

A summary of our 22 security policies.

PublicView the Security policy overview
Completed security questionnaire

A standard questionnaire, answered in full.

NDA

ISO 27001 certificate

Certificate: ISMS-4471-WL
Issued: Mar 14, 2025
Valid through: Mar 13, 2028
Issued by: An accredited certification body

Security policy overview

Information security and acceptable use
Access control and encryption
Incident response and business continuity
Vendor management and data retention

Reviewed and approved every year by our CTO and CISO.

Subprocessors

Who processes data for us

We give customers 30 days' notice before adding a subprocessor that handles customer data.

Subprocessors
Subprocessor	Purpose	Location	Data
Cirrova	Cloud hosting and storage	United States	All customer data
Altastack	Disaster recovery region	United States	Encrypted backups
Mailcrest Relay	Transactional email	United States	Names, email addresses
Tickbarrow	Customer support tickets	United States	Support conversations
Ledgerfin Billing	Subscription billing	United States	Billing contacts, invoices
Northvane Analytics	Product usage analytics	United States	Pseudonymous usage events

Request access

Request security documents

Customers and prospects can request our reports here. Our security team checks each request, usually within one business day.

Found a vulnerability? Email security@wardline.example. We reply within two business days and don't take legal action against good-faith research.