Theta Lake’s SOC 2, Type 2-audited Compliance Suite is a purpose-built platform that provides automatic detection of regulatory, privacy, and cybersecurity risks in audio, video, chat and other collaboration content. Theta Lake deploys industry-leading security and compliance controls to protect the security, confidentiality, and availability of information stored on the platform. The solution’s technical design is based on our Secure in Transit, Architecture, Rest, Redaction, and Removal (“STAR3”) architecture. Theta Lake’s staff includes privacy practitioners with CIPP/E and CIPP/US certifications as well as CPA, CISA, CISSP, and other security credentials.
ISO is a gold standard in certifying technology and process standards for security and trust where ISO/IEC 42001 is designed specifically for entities providing or utilizing AI-based products or services to ensure responsible development and use of AI systems.
ISO 27001
Theta Lake has implemented technical and organizational controls to align with the ISO 27001 information security management standard.
Theta Lake’s Compliance Suite has been evaluated by an independent, third-party auditor and is compliant with Payment Card Industry Data Security Standard (PCI DSS) for processing credit card data.
Theta Lake has completed the EcoVadis Sustainability Assessment.
Theta Lake completed TruSight’s third-party risk assessment as part of its ongoing efforts to align with financial services industry security best practices. Theta Lake’s report is available to TruSight customers upon request by contacting thirdparty@trusightsolutions.com.
Theta Lake has implemented controls to comply with the Security Rule of the Health Insurance Portability and Accountability Act of 1996 (HIPAA) and secure electronic protected health information (ePHI).
Infrastructure Security
All data is encrypted in transit and at rest. Customer-specific 256-bit encryption keys required for access and customer has the option to manage keys independently using Amazon Web Services or Microsoft Azure key management services.
Content ingested through customer-authorized APIs and services, or customer-controlled SSL-only uploads.
Protection of our app against SaaS account takeover, malware, and zero-day attacks targeting cloud infrastructure including container level vulnerability scanning.
Hosted in dedicated server environments at AWS and Azure, which are certified pursuant to multiple compliance and security regimes, such as SOC, ISO, CSA, and others.
Customers retain full control over retention and disposition of information in SEC 17a-4, WORM compliant archive.