Security & Trust Center / Independent Audits & Cryptographic Controls

Zero-trust verification without endpoint surveillance.

DeviceTrust operates in authentication decision paths with cryptographic minimization, tenant isolation, and auditable privacy boundaries.

AICPA Audited

SOC 2 Type II

Independently audited annually across Security, Availability, and Confidentiality Trust Services Criteria with continuous control monitoring.

Period: Annual ContinuousZero Exceptions

Certified ISMS

ISO/IEC 27001:2022

Certified Information Security Management System covering software engineering, cloud infrastructure operations, and cryptographic key lifecycle.

Annex A 2022 ControlsAccredited Registrar

Data Protection

GDPR & HIPAA BAA

Standard Contractual Clauses (SCCs), US and EU-Frankfurt regional data residency options, and HIPAA Business Associate Agreements for healthcare fleets.

DPA IncludedRegional Pinning

Employee Privacy Charter

Strict architectural boundaries on endpoint telemetry.

Employees accept endpoint security agents when they know their personal privacy is respected. Every enrolled user can open the local DeviceTrust tray menu to inspect exact check payloads sent during authentication.

Collected Security & Configuration Metadata

✓ Operating system version, kernel build, and pending security updates
✓ Full-disk encryption status (FileVault, BitLocker, LUKS2) & cipher state
✓ Hardware TPM 2.0 / Apple Secure Enclave public attestation key thumbprint
✓ Screen lock activation timeout and host firewall enablement
✓ Presence and running daemon health of approved EDR / antivirus sensors
✓ Metadata of installed applications and browser extension permission scopes

Hard-Blocked in Agent Never Collected or Accessible

× Browser history, visited URLs, search queries, or active tab titles
× Contents of personal or corporate documents, source code, or emails
× Keystrokes, clipboard contents, webcam feeds, or desktop screenshots
× Network packet payloads, DNS query logs, or TLS MitM decryption
× GPS / Wi-Fi physical geolocation coordinates of employee or BYOD devices
× Remote shell execution, file deletion, or remote device wipe commands

Zero Trust Control Mapping

Alignment with federal & enterprise frameworks.

Framework / Control	Requirement Summary	DeviceTrust Enforcement Mechanism
NIST SP 800-207 §3.2	Policy Engine Continuous Diagnostics & Mitigation (CDM)	Evaluates live endpoint osquery state at every OIDC/SAML handshake prior to issuing session grants.
OMB M-22-09 / CISA ZTMM	Phishing-Resistant Device-Bound Authentication	Signs authentication challenges with non-exportable ECDSA P-256 keys inside TPM 2.0 or Apple Secure Enclave.
SOC 2 CC6.1 & CC6.7	Logical Access & Endpoint Encryption Governance	Blocks cloud SaaS login from unencrypted volumes and streams hourly evidence directly to Vanta / Drata.
ISO/IEC 27001:2022 A.8.1	User Endpoint Devices & BYOD Risk Controls	Enforces uniform patch currency and host firewall standards on contractor and unmanaged developer laptops.
CIS Critical Control 4	Secure Configuration of Enterprise Assets	Ships 140+ CIS Benchmark posture queries for macOS Sequoia, Windows 11, and Ubuntu LTS out of the box.

Infrastructure Transparency

Authorized Cloud Subprocessors

DeviceTrust maintains strict per-tenant KMS envelope encryption across our cloud hosting providers.

Subprocessor	Purpose of Processing	Hosting Regions
Amazon Web Services, Inc.	Primary isolated tenant compute, KMS key management, and encrypted database storage	US-West (Oregon) / EU-Central (Frankfurt)
Google Cloud Platform	Edge OIDC/SAML posture assertion endpoints and authoritative DNS routing	United States / European Union
Postmark (ActiveCampaign, LLC)	Transactional admin alert delivery (no endpoint telemetry stored)	United States (SCCs Executed)