Our pre-SOC 2 position

Our pre-SOC 2 program brings together security controls, operational practices, evidence, and customer due diligence in preparation for independent assurance. Pre-SOC 2 describes our security and audit-readiness stage. It does not represent an independent SOC 2 report.

SOC 2 involves an independent CPA examination of scoped controls. A future examination and any issued report have their own scope, period, and conclusions. Cloud-provider assurance relates to the provider’s described system and does not, by itself, cover DaanVeda’s application or organization.

Account security and infrastructure

• Authenticator MFA is available in the main application’s Privacy & Security settings. Users enroll their account; an enrolled account requires the applicable second-factor evidence at session and protected-API boundaries.
• MFA setup and challenge dialogs use privacy controls for supported session-replay tools. MFA information must never be sent to our team in a routine enquiry.
• The main app is deployed on GCP, with SQL on GCP and some databases in AWS DynamoDB. AWS integrations also include S3 for files and SES for email.
• Country-specific hosting is arranged through a separate request, written scope, and separate billing.

Open Privacy & Security in the app.

Security program and customer due diligence

Our security program addresses access control, MFA, secrets handling, logging, incident response, backups / recovery, retention, supplier oversight, and changes to the service. Request security information for your organization’s due diligence or procurement questionnaire.

Customer-specific security commitments and any service levels are set out in the applicable agreement. Contact us for the relevant scope and evidence; this page does not replace a customer agreement or an independent assurance report.

Report a security concern

Email privacy@daanveda.com with the subject “Security concern”. Include an affected URL and a concise description without real customer data, credentials, or exploit attachments. Ask for a secure channel before sending sensitive evidence.

This contact route does not authorize testing, access to another person’s data, disruption, or a paid bounty. No payment or safe-harbor program is promised here.

Assurance reference

AICPA & CIMA: System and Organization Controls services.