Book a demo
Security and compliance

Security you can checkin our SOC 2® Type 1 report

Sfere encrypts customer data at rest and in transit, gives access only to the roles that need it, and logs who reaches it. An independent CPA firm examined these controls as of October 13, 2026

Book a demo → Request the report
AICPA SOC 2

SOC 2 Type 1 reportSecurity criteria · as of October 13, 2026

  • 256-bitAES encryption on stored data, temporary files and backups
  • 4× a yearWe review who can reach customer data
  • 1 business dayTo remove access when someone leaves
  • Every releaseScanned for security flaws before it ships

The controls in our SOC 2 report

The report covers the Sfere Platform as we run it for you on Google Cloud. Pick a control to see how it works

Encrypted in transit and at rest

Customer data stays encrypted while it moves between your systems and Sfere, and wherever we store it

  • In transitEncrypted whenever it crosses a public network
  • At rest256-bit AES in databases, temporary files and backups

Each person reaches only what their role needs

Everyone has their own login, and our critical systems require multi-factor authentication

  • Approved firstAccess is approved before it is granted
  • Reviewed quarterlyAnd removed within one business day when someone leaves

Access to customer data is logged and reviewed

We log privileged access and access to customer data, and access to our infrastructure is monitored continuously

  • ReviewedOur CTO reviews the logs
  • ProtectedAccess to logs is restricted, and admins cannot erase or switch off logs of their own activity

Every release is reviewed, scanned and tested

Code changes go through formal review, are scanned for security flaws before release and are tested away from production, which runs in its own isolated network

  • Scanned continuouslyContainers and our cloud environment
  • Penetration testedOn production, by an independent tester, at least once a year
AICPA SOC 2 The report

Read the full report before you sign

We share our SOC 2 Type 1 report in full, under NDA, with your security, legal or procurement team

Request the report → Book a review session

Scope

Examined by
An independent CPA firm
Criteria
Security, from the AICPA's Trust Services Criteria
As of
October 13, 2026
Covers
The Sfere Platform as we run it for you on Google Cloud
Outside it
Sfere in your own cloud account or on-premise, which runs on your infrastructure inside the security setup you already have Deployment options

Behind the controls

  • Trained every yearOur team completes security training every year
  • NDAs for contractorsContractors with access to customer data sign an NDA
  • Written plansFor incidents, disaster recovery, and how long data is kept and how it is deleted

Privacy rules you set, applied to every profile

Your legal team decides how customer data may be used and how long it is kept. Sfere applies those rules to every profile

  • Consent travels with the data

    Consent and purpose are stored with the data and enforced at the data layer, so a withdrawn consent applies everywhere instead of lingering in a copy

  • Keep only what you need

    Collect what a use case needs, set how long data is kept, and delete it on schedule

  • CCPA/CPRA and GDPR

    Sfere is CCPA/CPRA compliant, and GDPR principles (lawful basis, data-subject rights and minimization) are supported across the platform

  • You stay the controller

    Sfere runs your data under contract with you, or inside your own environment. See our privacy policy

FAQ Security

Questions from security teams

Something else on your mind? Talk to us

Can we read the SOC 2 report?

Yes. We share the full report under NDA with your security, legal or procurement team. Ask for it through our contact form

What does the report cover?

Sfere's controls relevant to security, for the Sfere Platform as we run it for you on Google Cloud, as of October 13, 2026. Sfere running in your own cloud account or on-premise sits on your infrastructure, outside the report

What is a SOC 2 Type 1 report?

A report by an independent CPA firm on how a company's controls are designed, as of one date. It follows the AICPA's Trust Services Criteria, and ours covers the security criteria

Who at Sfere can see our customer data?

Only people whose role needs it, each with their own login. Access is approved before it is granted, our critical systems require multi-factor authentication, access is reviewed every quarter, and it is removed within one business day when someone leaves

How do you find vulnerabilities?

Code is scanned for security flaws before every release, containers and our cloud environment are scanned continuously, and an independent tester runs a penetration test on production at least once a year

Can our security team review Sfere with you?

Yes. Book a review session and we will walk your reviewers through encryption, access, logging and consent in your deployment model

Free data assessment

Start with a clearer picture

In a free assessment, we review your data sources, identify gaps and explore growth opportunities. You leave with clear next steps for your team

Get a free data assessment → Have a question? Talk to us
  1. 01Your data mapYour sources, their connections and the gaps between them
  2. 02Growth opportunitiesWhere your existing audience could create more value
  3. 03Your first 90 daysClear priorities and written targets to get started