Compliance Center
Security & Compliance Overview
Everything your compliance team needs for vendor due diligence — policies, controls, and documentation in one place.
Last updated: March 2026
Compliance Posture
In Place
In Progress
Security Controls & Policies
17 policies adopted across six categories. Policy documents are available upon request.
Information Security
Access & Personnel
Infrastructure & Network
Risk & Incident Management
Operations & Change
Governance
Compliance Documents
Security Architecture
Encryption
AES-256 at rest, TLS 1.3 in transit. Per-family encryption keys for cryptographic isolation.
Full details →Data Residency
All data processed and stored exclusively in the United States on SOC 2 certified infrastructure.
Full details →Access Control
Role-based access control, mandatory MFA, per-family isolation boundaries. All access logged.
Full details →Monitoring
Continuous monitoring with automated threat detection, anomaly detection, and 24/7 incident response.
Full details →Frequently Asked Questions
What is your SOC 2 status?
entropyFA is hosted on SOC 2 Type II certified cloud infrastructure. Our own SOC 2 Type II certification is currently in progress. We have adopted 17 security policies aligned to the SOC 2 Trust Services Criteria and are working with an independent auditor.
Has entropyFA completed penetration testing?
Penetration testing is currently in progress. Results will be available upon request under NDA once complete.
What is the breach notification timeline?
72 hours from confirmation of a security incident involving client data. This is a contractual commitment in our Data Confidentiality Agreement, Section 6.
How is data isolated between clients?
Per-family data isolation with dedicated access boundaries and per-family encryption keys. Data is never commingled across households in queries, processing, or storage.
Can I get a list of subprocessors?
Yes. A current list of subprocessors is available upon request. Contact support@entropyfa.com.
Need additional documentation?
Additional compliance materials — including policy documents, penetration test results, and subprocessor lists — are available under NDA.
Contact Us