EasyCloudify™ leads every cybersecurity engagement end-to-end: contracting, governance, communication, and reporting. This Trust Center documents the security standards, data handling commitments, and operational practices that govern how we and our delivery partners work.
Last updated: June 2026
Our primary offensive security delivery partner has completed a SOC 2 Type 2 examination covering the Security Trust Services Criteria for penetration testing services. The examination was performed by an independent CPA firm and evaluates the design and operating effectiveness of controls over the review period.
SOC 2 reports are available under NDA to current and prospective clients upon request.
Our delivery partners are required to maintain comprehensive insurance coverage, including Commercial General Liability, Professional Liability (Errors & Omissions), Cyber Liability, Umbrella/Excess Liability, and Workers' Compensation. Certificates of insurance for the specific partner(s) engaged on your project are available upon request so you can verify current coverage and limits directly.
Project communications, findings, evidence, and reports are delivered through portals covered by the SOC 2 Type II examination — supporting role-based access controls, encrypted transmission, and full audit logging.
Remote access tooling enables secure, on-site-equivalent testing to any location in the world without requiring persistent VPN credentials or network access.
Every engagement aligns to the specific requirements and documentation standards of your regulatory framework.
| Framework | How EasyCloudify™ supports it |
|---|---|
| PCI DSS v4.0.1 | Requirement 11.4 internal and external testing, segmentation validation, and remediation retesting. |
| HIPAA | Security Rule risk analysis and evaluation supporting §164.308(a)(1)(ii)(A) and §164.308(a)(8). |
| SOC 2 | Technical testing evidence supporting Security Trust Services Criteria. |
| SOX | IT general controls and security testing evidence for financial reporting environments. |
| GLBA / Safeguards Rule | Periodic testing and vulnerability assessment under 16 CFR 314.4(d). |
| NIST SP 800-171 / CMMC | Security assessment support for organizations protecting CUI and DoD contractor environments. |
| ISO 27001:2022 | Technical vulnerability testing evidence for Annex A 8.8 management requirements. |
| GDPR Article 32 | Regular testing supporting Article 32(1)(d) effectiveness evaluation. |
| NIST CSF 2.0 | Exploitation evidence informing risk management across all six CSF functions. |
| FedRAMP | Cloud service provider testing aligned to FedRAMP Penetration Test Guidance. |
| MITRE ATT&CK | Adversary tactic, technique, and procedure mapping for red team and detection validation. |
| NIST SP 800-115 | Federal technical guide to information security testing and assessment — the methodology baseline for all engagements. |
Additional frameworks available upon request. Contact us to discuss specific requirements.
Our testers hold the certifications that validate deep offensive security expertise — not just familiarity with the tools. These represent the advanced techniques and adversary simulations delivered on every engagement.
Independent validation from market research firms, verified client reviews, and original vulnerability research.
2× Gartner
Listed as Sample Vendor in Gartner® Hype Cycle™ for Security Operations and Application Security (2023 & 2024)
5.0 / 5.0
Perfect rating on Clutch across independently verified client reviews
12 CVEs
Original vulnerabilities discovered by our team, disclosed through MITRE across ManageEngine, PRTG, Nagios XI, and Rock RMS
100+
Penetration tests delivered annually, with 85%+ success rate in Red Team engagements
We believe in transparency. If you need additional documentation — including SOC 2 reports, proof of insurance, or details about our security practices — we're happy to provide it.