Security at Ostorlab

Security Program Highlights

SOC 2 Type II report

Ostorlab has a SOC 2 Type II report for the Security criteria, covering 18 Nov 2024 – 18 Apr 2025. The audit for the current period is in progress.

A Type II audit evaluates how security controls operate over a sustained period, not just at a single point in time. To request a copy of the report for your vendor review, visit the Trust Center.

Data encryption

Your data is always encrypted at rest and in transit to and from our platform. We use Google Cloud Key Management service to manage encryption keys using hardware security modules for maximum security in line with industry best practices.

Hosting

Ostorlab is hosted using Google Cloud Platform services to offer the best guarantee possible in terms of physical and infrastructure security.

Platform's availability

Ostorlab's availability SLA is 99.5% and our Recovery Point Objective is 6 hours.

We ensure business continuity and disaster recovery through the concept of “availability zones” and geographical distribution offered by cloud infrastructure.

Security controls

Our Security assurance program combines 100+ security controls across the organization, including continuous automated scanning as well as a Bug Bounty program and a Responsible Vulnerability Disclosure Policy.