Cloudexmachina Trust Center

generated: '2026-08-17'
method: searched
probe: true
source: https://trust.cloudexmachina.io/
url: https://trust.cloudexmachina.io/
host: cloud-ex-machina.secureframetrust.com
platform: Secureframe Trust Center
certifications:
- SOC 2
- ISO 27001
- GDPR
certification_detail:
- {name: SOC 2 Type 2, status: achieved, verbatim: 'SOC 2 Type 2'}
- {name: ISO 27001, status: planned, target_year: 2026, verbatim: 'ISO 27001: Planned 2026.'}
- {name: GDPR, status: addressed, verbatim: 'GDPR: Data Processing Addendum (DPA) available.'}
subprocessors:
- {name: AWS, purpose: Cloud Provider}
- {name: Google LLC, purpose: Google Cloud Platform, AI/ML services}
- {name: Anthropic, purpose: AI/ML services}
- {name: Nango, purpose: Product integrations}
- {name: Sentry, purpose: Performance monitoring and error tracking}
controls_documented:
- incident response
- data retention and disposal
- encryption and key management
- vendor risk management
- uptime and availability monitoring
- confidential reporting channel
disclosure:
  policy_url: null
  contact: null
  bug_bounty: null
  note: >-
    The trust center lists a "Confidential Reporting Channel" control — "A confidential reporting
    channel is made available to internal personnel and external parties to report security and
    other identified concerns" — but publishes no reachable policy URL, no security contact address
    in the served HTML (contact addresses are rendered client-side and were not recoverable from
    the response body), and no bug bounty program. /.well-known/security.txt returns 404 on
    www.cloudexmachina.io and a soft-200 HTML shell elsewhere; www.cloudexmachina.io/security
    returns 404. Because no disclosure channel could be verified, NO VulnerabilityDisclosure or
    Security pointer is emitted in apis.yml. This is the single clearest, cheapest improvement
    available to Cloud ex Machina: publish an RFC 9116 /.well-known/security.txt naming a Contact
    and a Policy.
evidence:
- source: https://trust.cloudexmachina.io/
  http_status: 200
  keywords: [soc 2, iso 27001, trust center, gdpr, subprocessor, uptime]
- source: https://www.cloudexmachina.io/.well-known/security.txt
  http_status: 404
- source: https://www.cloudexmachina.io/security
  http_status: 404