Demostack Trust Center

generated: '2026-08-14'
method: searched
probe: true
source: https://www.demostack.com/trust-center
url: https://www.demostack.com/trust-center
description: >-
  Demostack publishes a trust center on its own marketing site rather than a
  hosted trust portal (no Vanta/Drata/SafeBase instance, no subprocessor list, no
  document request flow). It names its attestation, auditor and effective date,
  its privacy posture, its HIPAA position, its scanning and pentest tooling, and
  its vulnerability disclosure program.
certifications:
  - name: SOC 2 Type II
    auditor: PwC
    effective: '2023-10-31'
    opinion: unqualified
    statement: >-
      "Demostack has earned its SOC 2 attestation with PWC, effective October 31,
      2023. The Auditor's report is 'unqualified,' meaning no control gaps were
      identified."
    note: >-
      Demostack's own product-updates copy names it "SOC 2 Type II compliance
      through an audit by PwC". The effective date is 2023-10-31; no more recent
      report period is published.
  - name: HIPAA
    role: Business Associate
    statement: >-
      "Demostack is compliant with the HIPAA Privacy and Security standards as a
      Business Associate, and we have the policies, procedures and systems" to
      protect ePHI.
  - name: GDPR
    statement: >-
      "Demostack recognizes the importance of Privacy and Data Protection
      regulations such as GDPR and CCPA, and aligns with these and other
      frameworks. We promote Privacy by Design."
    dpa: Data Processing Agreement based on post-Schrems II Standard Contractual Clauses.
  - name: CCPA
    statement: Named alongside GDPR as a framework Demostack aligns with.
not_claimed:
  - ISO 27001
  - ISO 27017
  - ISO 27018
  - PCI DSS
  - FedRAMP
  - CSA STAR
security_posture:
  encryption: Data encrypted at rest and in flight.
  data_sales: '"We never sell your data to any third party."'
  continuous_scanning: [Google Security Command Center, Snyk]
  penetration_testing: HackerOne
  vulnerability_disclosure: security/demostack-vulnerability-disclosure.yml
  platform_controls: [SSO, RBAC]
  platform_controls_source: https://www.demostack.com/pricing
transparency:
  status_page: https://status.demostack.com/
  availability_statistics: 90-day availability published on the status page
gaps:
  - No subprocessor list published.
  - No document request / NDA flow for the SOC 2 report.
  - No hosted trust portal (trust.demostack.com does not resolve).
  - The published SOC 2 effective date is 2023-10-31 with no newer period named.
evidence:
  - source: https://www.demostack.com/trust-center
    http_status: 200
    keywords: [soc 2, pwc, hipaa, gdpr, ccpa, hackerone, snyk, vulnerability disclosure program]
  - source: https://www.demostack.com/security
    http_status: 200
    keywords: [soc 2, trust center]