SOC 2 Type II

Cust holds a SOC 2 Type II attestation covering the Security, Confidentiality, and Availability Trust Services Criteria, for the period November 28, 2025 to February 28, 2026, issued by an independent CPA firm with an unqualified opinion and no exceptions noted.

Penetration testing

We run third-party penetration tests on at least an annual cadence. Test reports are available on request, alongside our remediation work for any findings.

Cust supports GDPR-aligned data handling. Customers are the data controller and Cust is the data processor for any personal data flowing through the platform. See Data handling for the controller and processor model in detail.

HIPAA

Cust supports HIPAA-aligned configurations for customers operating in regulated healthcare environments. Contact support@cust.co to discuss your specific requirements.

CASA

Cust is CASA (Cloud Application Security Assessment) verified, which is the security standard required for OAuth integrations with Google Workspace.

Request our security artifacts

Email support@cust.co to receive the SOC 2 Type II report, our latest penetration test summary, and any other due-diligence materials your team needs.