Trust Center
Security is not a checkbox.
It's the product.
We hold ourselves to the same standards we help our customers achieve. Here is a transparent view of how we protect your data.
Certifications & Controls
Our security program is designed to meet the highest standards demanded by enterprise GRC customers.
SOC 2 Type II
SOC 2 TYPE IIAudited annually by an independent CPA firm against Security, Availability, and Confidentiality trust service criteria. Reports available under NDA.
Encryption at Rest
AES-256All customer data encrypted with AES-256. Encryption keys managed in a dedicated KMS with quarterly rotation.
Encryption in Transit
TLS 1.3TLS 1.3 enforced for all data in transit. TLS 1.0 and 1.1 are disabled. Certificate transparency enforced via CAA records.
Access Control
ZERO TRUSTMandatory MFA for all Vigil employees. Role-based access control with least-privilege enforcement. Privileged access reviewed quarterly with auto-revocation.
Penetration Testing
ANNUALAnnual third-party penetration test conducted by a CREST-accredited firm. Critical findings remediated within 24 hours; high within 7 days.
Vulnerability Management
CONTINUOUSContinuous automated vulnerability scanning across all infrastructure. CVEs tracked and triaged daily against CVSS severity thresholds.
GDPR & CCPA
COMPLIANTData Processing Agreements available for EU/UK customers. CCPA opt-out mechanisms in place. DPO appointed; EU data residency options available.
Information Security
ISO 27001Controls aligned to ISO/IEC 27001:2022. Full certified audit in progress. Internal audit program reviewed semi-annually.
Infrastructure & Availability
Built on enterprise-grade cloud infrastructure with redundancy at every layer.
Policies & Practices
Security is a company-wide responsibility built into how we operate.
Request Security Documentation
SOC 2 Type II report, penetration test executive summary, and Data Processing Agreement (DPA) are available to prospective and current customers under NDA.