InheritedInfrastructure (AWS)
ISO 27001:2022, ISO 27017/018, PCI DSS L1
AWS holds ISO 27001:2022. Provider certifications do not certify the ScreenComply application.
Security & certifications
A security posture institutions can defend.
ScreenComply helps employers, universities and testing programs trust assessment results with evidence and human review. Security and privacy requirements are reviewed with your team. Security and compliance documentation is shared after an introductory call.
CSA STAR L1 · HECVAT Lite
At a glance
The numbers behind our posture.
Concrete evidence - not vague reassurance. Every figure below is backed by a document on file, available to procurement and security review teams.
38 / 38Trust Services Criteria controls in place
Monthlypenetration testing, with findings tracked to closure
0known vulnerabilities in production dependencies (pip-audit, June 2026)
Certifications & assessments
Where we stand across every layer.
Inherited certifications come from our hosting and edge providers. Application-level certifications are tracked at the ScreenComply application and desktop agent directly, audited against the same evidence customers receive.
InheritedEdge (Cloudflare)
ISO 27001, ISO 27701, PCI DSS L1, CSA STAR L1
Cloudflare holds ISO 27001. Provider certifications do not certify the ScreenComply application.
CompleteScreenComply Application
CSA STAR Level 1 (CAIQ v4.0.3)
Completed June 2026. Published to the CSA STAR Registry (star.watch).
CompleteScreenComply Application
HECVAT Lite
Completed June 2026. Published to the HECVAT Cloud Broker Index.
PassedScreenComply Application
Internal Penetration Test
Monthly penetration testing, with findings tracked to closure.
ActiveCustomer workflow
Institutional Setup Review
Review your setup and governance needs with our team.
In progressScreenComply Application
ISO 27001:2022
Discuss the current assessment status and supporting documentation with our team.
InitiatedScreenComply Application
Third-Party Penetration Test
Security assessment documents shared with qualified teams under NDA.
CSA STAR Registry entry published at star.watch · HECVAT Cloud Broker Index entry available on request
Security review
Trust Services Criteria controls in place.
Security and compliance documentation is shared after an introductory call.
TSC familyTotalIn placePartialGap
CC1 - Control Environment5500
CC2 - Communication3300
CC3 - Risk Assessment4400
CC4 - Monitoring2200
CC5 - Control Activities3300
CC6 - Logical & Physical Access8800
CC7 - System Operations5500
CC8 - Change Management1100
CC9 - Risk Mitigation2200
A1 - Availability3300
C1 - Confidentiality2200
Total383800
Review security documentationSecurity and compliance documentation is shared after an introductory call.
Penetration test
Monthly penetration testing.
Security assessment documentation supports institutional procurement review. Request the detailed security package for your IT, privacy and compliance teams.
CriticalTracked
HighTracked
MediumTracked
LowTracked
Controls confirmed effective
VERIFIED DURING THE REVIEW PASS
- Evidence supports institutional security review.
- Access governance is part of the review conversation.
- Customer information is handled under agreed terms.
- Review decisions remain with qualified human teams.
- Security documents are available for procurement review.
- Data retention requirements fit customer policy.
- Privacy requirements are reviewed before deployment.
- Oversight supports informed institutional decisions.
- Clear documentation supports follow-up review.
- Contact our team for the detailed security package.
Defense-in-depth additions
HARDENING BEYOND THE FINDINGS
- Agree security requirements with your IT and compliance teams.
- Review the available documents before making a procurement decision.
- Keep governance and human review central to deployment.
Dependency scanning - pip-audit, June 16, 2026Supporting security review documents are available from our team under NDA.
Sub-processors
Full transparency on who touches customer data.
Signed DPAs are maintained for all critical vendors. 30-day advance notice is provided for any material change to sub-processors. Annual vendor compliance audits - next review June 1, 2027.
Vendors receiving customer data by default
Amazon Web Services
Infrastructure provider. Supporting documents are available for security review.
Cloudflare
Infrastructure provider. Supporting documents are available for security review.
Vendors receiving data on customer opt-in
Google Workspace
Optional support for the Workspace workflow your team already uses.
Zoom
Optional support for your existing meeting review workflow.
Resend
Transactional notifications for the agreed customer workflow.
Prohibited third-party integrationsScreenComply does not use any of the following with candidate data:
- Public LLM APIs (OpenAI / Anthropic) for candidate data
- Third-party analytics (Google Analytics / Mixpanel)
- Marketing pixels (Meta / LinkedIn)
- External chat / support widgets (Intercom / Drift)
Talk to security
Need our security package for procurement?
Send security questionnaires, DPA requests, or pentest report requests to our security team. Typical response within 2 business days.