SOC 2 Type II
Current (latest report November 2025). Covers security, availability, and confidentiality trust criteria. Report available under NDA.
Trust center
Security, hosting, and sub-processors, all in one place
Procurement-grade documentation. No NDA required to read this page; audit reports and pen-test letters are one email away. If it’s not here, ask security@colport.io. We reply within 1 business day.
Last updated: 21 April 2026
Last updated: 21 April 2026
Certifications
Where we stand
ISO/IEC 27001:2022
Certification in progress, target Q3 2026. Pre-certification internal audit complete. Stage 1 external audit booked.
GDPR / AVG
DPO appointed. ROPA maintained. DPIAs on every AI feature. Data-subject rights fulfilled via self-service /me/my-data endpoint.
EU-U.S. Data Privacy Framework
Self-certified under DPF for the limited US-region transfers that a handful of North American customers request. Certification ID on request.
AI infrastructure
Which AI powers ColPort — and where it runs
Anthropic (Claude) — default
Our default model provider. US-hosted under Anthropic's DPA + EU Standard Contractual Clauses, on a zero-retention API: your inputs are never stored or used to train models.
Mistral (EU) — data-residency option
Each customer organisation can switch its AI to Mistral, processed inside the EU (France) with no third-country transfer. Toggle it in Admin → AI settings.
No personal data to the model
Authoring inputs are a topic, audience labels, and source material you supply — learner names, emails, and scores are never sent, and payloads are PII-scrubbed before they leave Hall.
AI never scores or grades
AI only drafts content for human review. All assessment scoring, pass/fail, completion, and compliance reporting are computed deterministically from the SCORM / xAPI results and analysed by a person — the AI makes no measurement decisions. This keeps Hall in the EU AI Act's limited-risk tier.
AI Act transparency
AI-generated draft content is labelled as such, and every AI feature sits behind an org-level opt-in with a DPIA attestation (EU AI Act Art. 50 + GDPR Art. 35).
Technical + organisational measures
Annex II of the DPA, summarised
Encryption
AES-256 at rest (Supabase + R2 + encrypted backups). TLS 1.3 in transit. Phone numbers AES-256 with separate key + auth tag. SSO client secrets AES-256-GCM with env-var-held ENCRYPTION_KEY.
Access control
Least-privilege RBAC. Multi-factor authentication mandatory for admin + engineering. SSH via short-lived certificates (Teleport). Production database access is audited + reviewed quarterly.
Resilience
Multi-AZ Postgres replication. Daily encrypted backups retained 30 days. Quarterly restore drills. RPO 15 min · RTO 4 hours. Status page at /status (Sprint 98).
Monitoring
Sentry error tracking. Pino structured logs. Upstream + downstream health checks. On-call rotation for P0/P1 incidents. SLA credits on /pricing.
Sub-processor list
10 sub-processors, all disclosed
Every third party that processes customer data under Article 28 of the GDPR. Changes are announced 30 days in advance via the trust center RSS feed, object within the notice window and we work with you on alternatives.
| Processor | Purpose | Region | Attestation |
|---|---|---|---|
Supabase Database + file storage | Primary Postgres + Row-Level Security + pgvector + encrypted backups | EU (Frankfurt) | SOC 2 Type II · ISO 27001 |
Vercel Application hosting + edge | Next.js app hosting, edge functions, CDN | EU (Frankfurt + Paris) | SOC 2 Type II · ISO 27001 |
Hetzner Backend workers + job queue | pg-boss queue, AI processing, heavy background jobs | EU (Falkenstein, DE) | ISO 27001 |
Cloudflare R2 Video + static assets | Course video, branded assets, CDN with zero egress fees | EU (FRA / AMS) | SOC 2 Type II · ISO 27001 · PCI DSS |
Anthropic AI model provider (Claude API) | AI assistants, generation endpoints (anonymised payloads only) | EU (via SCC 2021/914). USA backend | SOC 2 Type II |
Resend Transactional email | Invitation emails, renewal reminders, compliance digests | EU (selected) | SOC 2 Type II |
CM.com SMS gateway (primary) | SMS tokenised learning delivery + STOP keyword handling | EU (Netherlands) | ISO 27001 · ISO 9001 |
Twilio SMS gateway (global fallback) | SMS delivery where CM.com coverage is absent | EU (Ireland) | SOC 2 Type II · ISO 27001 · PCI DSS |
Sentry Error tracking | Application error + performance monitoring (PII stripped in beforeSend) | EU | SOC 2 Type II · ISO 27001 |
Upstash Redis (rate limits + cache) | Sliding-window rate limiting, short-TTL cache | EU | SOC 2 Type II |
Responsible disclosure
Report a security issue
We welcome coordinated disclosure from security researchers. Email security@colport.io with a description, reproduction steps, and your preferred credit. We acknowledge within 24 hours, triage within 72, and publish a patch within the severity-bound SLA below. Safe-harbour commitment: we never pursue legal action against researchers who follow this policy.
P0 (RCE, data exfil)
Acknowledge ≤ 4h · Patch + advisory ≤ 48h · Reward up to €5,000 (at our discretion; scaled to severity + impact).
P1 (auth bypass, privilege escalation)
Acknowledge ≤ 24h · Patch ≤ 7d · Reward up to €2,000.
P2 (CSRF, stored XSS)
Acknowledge ≤ 48h · Patch ≤ 30d · Hall of fame + optional reward.
P3 (cosmetic, low-impact)
Acknowledge ≤ 5 business days · Patch at next scheduled release · Hall of fame.
Request documents
Procurement-ready artifacts
SOC 2 Type II report
Available under NDA. Email security@colport.io with your organisation + the requesting procurement team.
Signed DPA + SCCs
Standard DPA + SCC 2021/914 attached to every order form. Available pre-contract from dpo@colport.io.
Pen-test letter
Annual third-party penetration test summary, current version (Q1 2026) available under NDA.
Business Continuity Plan
BCP + Disaster Recovery Plan documented, tested quarterly. Summary + latest drill report under NDA.
Need anything that’s not here?
Email security@colport.io, procurement-grade replies within 1 business day.
Request a demo