Trust Center
Your app binaries, source code and security reports are sensitive. Here is how we protect them, and how to run your vendor review.
At a glance
The controls security and procurement teams ask about first.
Compliance
Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). A Type II audit evaluates how security controls operate over a sustained period, not just at a single point in time.
Encryption
All customer data, including app binaries, source code and reports, is encrypted at rest and in transit.
Infrastructure
Ostorlab runs on Google Cloud infrastructure with Hardware Security Modules. On-premises scanners execute scans locally and send results and status to the cloud platform for orchestration and reporting.
Explore on-premises scanningData residency
Enterprise plans let you choose a hosting region: US data residency, EU hosting, GCC data sovereignty with cloud isolation, or APAC hosting.
AI and your data
BYOK uses your own AI-provider account, credentials and model, with a spend limit per scan. Data is sent to the selected provider; retention and training policies depend on the provider and account. Ask our security team for policy details.
Access control
Single sign-on with SAML, role-based access control and audit logs are available as an add-on and included on Enterprise.
Data handling
AI-provider data flows, local execution, cloud reporting and data controls.
AI-powered scans, such as the Deep Agentic Scan, the multi-asset scan, the Mobile Shielding Scan and the Single Vulnerability Assessment, use an AI provider you choose when you set up the scan: Cyber Models, which runs on Ostorlab's provider account and is paid with prepaid credits, or BYOK, which runs on your own provider account and is billed by your provider. Fast, Full and Exhaustive scans and attack surface scans need no AI provider.
An on-premises scanner runs scans on infrastructure you control: mobile apps, web apps and APIs, private networks and source code, depending on your license. It is a daemon for Linux or macOS that connects to the Ostorlab platform with an organization API key and receives the scans you send it. It runs them locally and reports the results to the platform, along with its status, including its IP address, CPU and memory.
You can archive scans from your scan list, delete assets from your attack surface, delete BYOK provider keys and delete Copilot conversations yourself. Archiving a scan permanently deletes its data.
For retention and deletion periods, the list of subprocessors, and how your data moves through Ostorlab, where it is stored and who can access it, ask the security team as part of your review.
Ask about your data flows
Compliance
Ostorlab has a SOC 2 Type II report covering the Security criteria, for the audit period 18 Nov 2024 – 18 Apr 2025 (the audit for the current period is in progress). Unlike a Type I report, which looks at control design on a single date, a Type II audit tests how those controls operate over the audit period.
Analyst recognition
Ostorlab is named a Sample Vendor for Mobile Application Security Testing in the Gartner® Hype Cycle™ for Application Security, 2025, published on 22 July 2025.
Documentation
Public guides your security and IT teams can review before a call.
Encryption and key management, hosting, availability and the security program.
Read the guideThe addresses scans and integrations come from, to allowlist in your WAF or firewall.
Read the guideInstall a scanner inside your own network and run scans from there.
Read the guideAdd your own LLM provider key and choose the model that AI-powered scans use.
Read the guideSet up SSO with Azure Active Directory, Google Workspace, Okta or OneLogin.
Read the guideLimit what each team can see and change, based on the owners they can access.
Read the guideVendor review
Tell us what your review needs and our team will get back to you with the documents and answers.
Or emailcontact@ostorlab.co
Request a copy of our latest SOC 2 Type II report for your review.
Request the reportSend us your questionnaire and we will complete it for your procurement process.
Send your questionnaireAsk how your data moves through Ostorlab, where it is stored and who can access it.
Ask about your data flows