Security and compliance
PingAura is certified to ISO/IEC 27001:2022, certificate IC-IS-2608130, issued by INTERCERT and valid to 10 August 2027. We are also SOC 2 Type II compliant. Here are the details of our certification, controls, and how to request our SOC 2 Type II report.
ISO/IEC 27001:2022
- Certificate number
- IC-IS-2608130
- Certification body
- INTERCERT
- Issued
- 11 August 2026
- Valid until
- 10 August 2027
Verify this certificate on IAF CertSearch, the International Accreditation Forum's public register. You do not need to contact us to confirm it.
Scope: the design, development, maintenance and operation of the PingAura AI visibility and optimisation platform, including the supporting engineering, product, sales and operations functions. The platform runs entirely on public cloud infrastructure, so physical infrastructure controls are inherited from those providers.
SOC 2 Type II
PingAura is SOC 2 Type II compliant. The SOC 2 Type II report is private and available to customers and prospects on request under NDA. Email security@pingaura.ai to request access.
How customer data is protected
- Encryption
- Sensitive fields are encrypted at the application level with AES-256-GCM before they reach the database, which is itself encrypted at rest with AES-256 by the provider. Traffic is TLS in transit.
- Tenant isolation
- Access is enforced in the database by row level security, so a query carries its own authorisation rather than relying on application code to remember the check.
- Data residency
- The database of record is hosted in Mumbai, India. Sub-processors and their locations are listed in full on the sub-processors page.
- Audit trails
- Privileged and administrative operations are logged with the acting user and a timestamp.
- Penetration testing
- Annual vulnerability assessment and penetration testing by a CERT-In empanelled auditor, with findings remediated and retested before the certificate is reissued.
- Access control
- Role based access with least privilege, and secrets held in a managed secret store rather than in code or configuration files.
Reporting a vulnerability
Email security@pingaura.ai. Please include enough detail to reproduce the issue. We will acknowledge receipt and keep you updated until it is resolved.
A copy of the ISO 27001 certificate, our data processing agreement, and the security whitepaper are available to customers and prospects on request through the same address. The SOC 2 Type II report is available on request under NDA.