Built for security-first teams
EQIQs handles sensitive participant, employee, and relationship data. Here's how we protect it, and the compliance posture we maintain.
Certifications & Compliance
Enterprise customers can request our latest security questionnaire (CAIQ-Lite), pen test summary, and SOC 2 audit timeline via security@eqiqs.com.
Controls in production today
Security
- TLS in transit, AES-256 at rest (managed Postgres)
- Row-Level Security enforced on user-scoped tables
- bcrypt password hashing + PKCE OAuth flow
- Constant-time API key comparison (timing-attack resistant)
- Automated dependency scanning on every commit (npm audit)
- Server-side admin role checks via SECURITY DEFINER functions
Availability
- Managed Postgres with daily backups
- Point-in-time recovery available
- Globally distributed edge functions
- Public status page at /status (live browser-side checks)
- Automated error alerts to on-call email
Confidentiality
- Per-user / per-workspace data isolation via RLS
- Customer relationship data not used for third-party model training
- Subprocessor list published at /subprocessors
- Standing DPA published at /legal/dpa (counter-signed copy on request: privacy@eqiqs.com)
Processing Integrity
- Idempotency keys supported on all mutating API endpoints
- Stripe webhook idempotency deduplication (stripe_event_log)
- Admin audit log (admin_audit_log) for privileged actions
- Data sufficiency rule holds compatibility scoring until at least 3 frameworks are completed
Privacy
- GDPR + CCPA aligned (EU/UK/CA residents)
- Account deletion via Settings; cascade removes related rows
- Shared report tokens — purgeable via automated job
- Comparison invites auto-purged after 90 days completed / 60 days pending
- Right-to-export: contact privacy@eqiqs.com
SOC 2 Type II readiness
EQIQs is not yet SOC 2 certified. Below is an honest mapping of Trust Services Criteria to controls already in production, so security and procurement teams can evaluate gaps before the formal audit completes.
| Criteria | Status | Evidence in production |
|---|---|---|
| CC6 — Logical access | Implemented | RLS on every user-scoped table, has_role() SECURITY DEFINER, separate user_roles table, SSO/SAML, PKCE OAuth |
| CC7 — System operations | Implemented | Sentry error monitoring, client_error_log, on-call email alerts, /status page, edge function logs |
| CC8 — Change management | Implemented | Git-based deploys, dependency scanning (npm audit), code review on all merges |
| CC9 — Risk mitigation | Partial | Quarterly third-party pen test, subprocessor list maintained; formal risk register pending audit |
| A1 — Availability | Implemented | Daily backups, 7-day PITR, multi-region edge, documented RTO 4h / RPO 1h |
| C1 — Confidentiality | Implemented | AES-256 at rest, TLS 1.3 in transit, per-workspace isolation, no training on customer data |
| P — Privacy (GDPR/CCPA) | Implemented | One-click export, 90-day deletion, published DPA at /legal/dpa, SCCs with subprocessors |
| Independent SOC 2 audit | Not commissioned | Type I considered on Organization or Enterprise prospect request; no committed Type II date |
Need the full readiness packet for vendor review? Email security@eqiqs.com.
Reference documents
Responsible disclosure
Report security vulnerabilities to security@eqiqs.com. We acknowledge within 48 hours and resolve critical issues within 7 days.
Please give us 90 days before public disclosure. Researchers who report in good faith are recognized on our security hall of fame and may be eligible for swag or cash rewards on critical findings.
Contact
How EQIQs protects your people
What each person controls, what managers and sponsors can and can't see.
Decision-support only — not for hiring, firing, promotion or pay decisions.