Inherited from our hosting providers (AWS, Cloudflare)
InheritedInfrastructure (AWS)
ISO 27001:2022, ISO 27017/018, PCI DSS L1
AWS holds ISO 27001:2022. Provider certifications do not certify the ScreenComply application.
Security posture and controls
A security posture institutions can defend.
ScreenComply helps universities, assessment platforms and employers trust assessment results with evidence and human review. Security and privacy requirements are reviewed with your team. Security and compliance documentation is shared after an introductory call.
HECVAT Lite · Security documentation
At a glance
Controls and ongoing security review.
Concrete evidence - not vague reassurance. Every figure below is backed by a document on file, available to procurement and security review teams.
38 / 38Trust Services Criteria controls in place
Monthlypenetration testing, with findings tracked to closure
Hosting certifications and application assessments
Where we stand across every layer.
Inherited certifications come from our hosting and edge providers, not from ScreenComply itself. Application assessments and the institutional questionnaire are listed separately. SOC 2 Type 2 examination in progress.
Inherited from our hosting providers (AWS, Cloudflare)
InheritedEdge (Cloudflare)
ISO 27001, ISO 27701, PCI DSS L1, CSA STAR L1
Cloudflare holds ISO 27001. Provider certifications do not certify the ScreenComply application.
Examination in progressScreenComply Application
Application security assessment
SOC 2 Type 2 examination in progress
PublishedInstitutional questionnaire
HECVAT Lite
Published to the EDUCAUSE Cloud Broker Index. Request the current questionnaire for review.
OngoingScreenComply Application
Penetration testing
Monthly penetration testing, with findings tracked to closure.
HECVAT Lite published to the EDUCAUSE Cloud Broker Index.
Security review
Trust Services Criteria controls in place.
Security and compliance documentation is shared after an introductory call.
TSC familyTotalIn placePartialGap
CC1 - Control Environment5500
CC2 - Communication3300
CC3 - Risk Assessment4400
CC4 - Monitoring2200
CC5 - Control Activities3300
CC6 - Logical & Physical Access8800
CC7 - System Operations5500
CC8 - Change Management1100
CC9 - Risk Mitigation2200
A1 - Availability3300
C1 - Confidentiality2200
Total383800
Review security documentationSecurity and compliance documentation is shared after an introductory call.
Penetration test
Monthly penetration testing.
Security assessment documentation supports institutional procurement review. Request the detailed security package for your IT, privacy and compliance teams.
CriticalTracked
HighTracked
MediumTracked
LowTracked
Controls confirmed effective
VERIFIED DURING THE REVIEW PASS
- Evidence supports institutional security review.
- Access governance is part of the review conversation.
- Customer information is handled under agreed terms.
- Review decisions remain with qualified human teams.
- Security documents are available for procurement review.
- Data retention requirements fit customer policy.
- Privacy requirements are reviewed before deployment.
- Oversight supports informed institutional decisions.
- Clear documentation supports follow-up review.
- Contact our team for the detailed security package.
Defense-in-depth additions
HARDENING BEYOND THE FINDINGS
- Agree security requirements with your IT and compliance teams.
- Review the available documents before making a procurement decision.
- Keep governance and human review central to deployment.
Dependency security reviewSupporting security review documents are available from our team under NDA.
Sub-processors
Full transparency on who touches customer data.
Review sub-processor information and the data processing agreement with our team. The agreed terms describe data handling and how changes are communicated.
Vendors receiving customer data by default
Amazon Web Services
Infrastructure provider. Supporting documents are available for security review.
Cloudflare
Infrastructure provider. Supporting documents are available for security review.
Vendors receiving data on customer opt-in
Google Workspace
Optional support for the Workspace workflow your team already uses.
Zoom
Optional support for your existing meeting review workflow.
Resend
Transactional notifications for the agreed customer workflow.
Prohibited third-party integrationsScreenComply does not use any of the following with candidate data:
- Public LLM APIs (OpenAI / Anthropic) for candidate data
- Third-party analytics (Google Analytics / Mixpanel)
- Marketing pixels (Meta / LinkedIn)
- External chat / support widgets (Intercom / Drift)
Talk to security
Need our security package for procurement?
Send security questionnaires, DPA requests, or pentest report requests to our security team. Share the documents your review requires.