Trust Center
Controls
The controls our SOC 2-aligned program operates, grouped by category. Control detail, including cadence and SOC 2 criteria, is shared on request.
Access
5 controls- Quarterly user access reviews across all systems
- Two-factor authentication required on the GitHub organization
- Access granted least-privilege via onboarding checklist
- Timely access revocation on departure
- Role-based access within Freshly Secure itself
Availability
2 controls- Backups verified by a restore test
- Incident response plan tested by tabletop exercise
Change management
2 controls- Peer review enforced before production code changes
- Static analysis and dependency scanning in CI
Governance
3 controls- Security policies approved, published, and acknowledged
- Annual risk assessment with scored register
- Monthly automated GitHub evidence snapshot
People
1 control- Annual security awareness training with comprehension checks
Vendors
1 control- Annual vendor and subprocessor risk reviews
Vulnerability management
2 controls- Dependabot alerts triaged within SLA
- Secret scanning with push protection