Tested. Trusted. Assured.
PumpCX Trust Center
Transparency into PumpCX's security practices, compliance attestations, and the controls that protect customer data. Access audit reports by registering below.
Compliance
Compliance & Attestations
PumpCX maintains independent attestations and compliance programs to ensure your data is handled with the highest standards of security and privacy.
Hypertech Solutions Pty Ltd, trading as PumpCX, holds a SOC 2 Type 2 attestation report covering the Security trust services criteria and the applicable requirements of the HIPAA Security and Breach Notification Rules. The report was issued by Sensiba LLP for the period 1 January 2026 to 31 March 2026, for our Software as a Service System, and the examination reported no exceptions. Report available under NDA.
- Entity
- Hypertech Solutions Pty Ltd, trading as PumpCX
- Standards
- SOC 2 Type 2HIPAA Security and Breach Notification Rules
- Criteria
- Security trust services criteria
- Attesting firm
- Sensiba LLP
- Observation period
- to
- Report date
- Scope
- Software as a Service System
- Result
- No exceptions reported
The observation period ended . A bridging letter from PumpCX Management covers the interval since that date and is available alongside the report.
HIPAA
Attested by Sensiba LLP
1 January to 31 March 2026
SOC 2 Type 2
Attested by Sensiba LLP
1 January to 31 March 2026
Independent security assessments validate PumpCX's controls and compliance. Access full audit reports and penetration test summaries by registering above.
HIPAA & Business Associate Agreements
PumpCX supports HIPAA-compliant deployments and will enter into a Business Associate Agreement (BAA) with customers handling Protected Health Information (PHI). The BAA is available for signing via the Reports page.
Ongoing Assurance
Continuous control monitoring
Continuous monitoring shows our controls are on right now; the SOC 2 Type 2 report above shows they operated effectively across the 1 January 2026 to 31 March 2026 observation period. The two are complementary — a live control check is not a substitute for an independent examination over time.
Infrastructure Security
5/5 passing- Device and media disposal policies implemented
- Production inventory maintained
- Device and media movement recorded
- Media re-use procedures implemented
- Media removal policies implemented
Business Continuity & Disaster Recovery
11/11 passing- Continuity and Disaster Recovery plans established
- Continuity and Disaster Recovery plans tested
- Cybersecurity insurance maintained
- Application and data criticality analyzed
- Contingency operations established
- Contingency plan established
- Contingency plan tested and revised
- Data backed up and stored
- Data backup plan implemented
- Disaster recovery plan established
- Emergency mode operation plan established
Configuration Management
1/1 passing- Configuration management system established
Internal Security Procedures
3/3 passing- Change management procedures enforced
- Production deployment access restricted
- Development lifecycle established
Compliance
3/3 passing- SOC 2 - System Description
- Whistleblower policy established
- Security controls evaluated
Cryptographic Protections
7/7 passing- Unique production database authentication enforced
- Portable media encrypted
- Unique account authentication enforced
- Encryption and decryption controls implemented
- Data transmission encrypted
- Data transmission integrity maintained
- Data transmission secured
Data Classification & Handling
2/2 passing- Data classification policy established
- Data retention and time limit
Endpoint Security
2/2 passing- Anti-malware technology utilized
- Workstation security implemented
Security & Privacy Governance
15/15 passing- HIPAA security officer
- Policies and procedures activity documented
- Backup processes established
- Policies and procedures available
- Policies and procedures created
- Policies and procedures documented
- Management roles and responsibilities defined
- Policies and procedures updated
- Organization structure documented
- Security violations managed
- Roles and responsibilities specified
- Security responsibility assigned
- Workstation security policies implemented
- Security policies established and reviewed
- Support system available
Human Resources Security
7/7 passing- Sanction policy applied
- Employee background checks performed
- Code of Conduct acknowledged by contractors
- Code of Conduct acknowledged by employees and enforced
- Confidentiality Agreement acknowledged by contractors
- Confidentiality Agreement acknowledged by employees
- Performance evaluations conducted
Identification & Authentication
25/25 passing- Access authorized
- Access controls applied
- Access established, reviewed and modified
- Workforce authorized and/or supervised
- Production application access restricted
- Log-off automated
- Access control procedures established
- Emergency access procedures established
- Production database access restricted
- Firewall access restricted
- Termination procedures established
- Production OS access restricted
- Information access managed
- Production network access restricted
- Access reviews conducted
- Person or entities authenticated
- Access revoked upon termination
- Access requests required
- Unique user identified
- Unique network system authentication enforced
- Workforce clearance procedures implemented
- Password policy enforced
- Workforce security implemented
- Remote access MFA enforced
- Remote access encrypted enforced
Incident Response
9/9 passing- Additional breach information
- Breach notice identification of individuals
- Incident response plan tested
- Group Health Plan – Incident Reporting Required in Plan Documents
- Incident response policies established
- Notification of breach
- Security incidents identified and reported
- Security incident procedures implemented
- Timeliness of breach notification
Information Assurance
2/2 passing- Control self-assessments conducted
- Penetration testing performed
Mobile Device Management
1/1 passing- MDM system utilized
Continuous Monitoring
4/4 passing- Log management utilized
- Audit controls implemented
- Data integrity maintained
- Mechanism to authenticate ePHI implemented
Network Security
5/5 passing- Data transmission encrypted
- Network segmentation implemented
- Network firewalls reviewed
- Network firewalls utilized
- Network and system hardening standards maintained
Maintenance
1/1 passing- Maintenance records maintained
Security Operations
1/1 passing- Vulnerability and system monitoring procedures established
Physical & Environmental Security
2/2 passing- Access control and validation procedures implemented
- Physical access processes established
106 of 106 controls passing — updated less than 1 minute ago via Vanta.
Need our compliance reports?
Register with your business email and sign our NDA to access and download SOC 2 reports, penetration test results, Security Architecture Overview, HIPAA Compliance Overview & Business Associate Agreement.
Register for AccessSecurity
Data Protection Overview
Protecting customer data is fundamental to PumpCX's platform design and operations.
PumpCX applies a defense-in-depth approach to safeguard customer data across infrastructure, application, and operational layers. Security controls are continuously monitored and regularly reviewed as part of our compliance and security program.
Encryption
- All data is encrypted in transit using TLS 1.2 or higher (TLS 1.3 preferred).
- Customer data stored on AWS storage volumes is encrypted at rest using AES-256 disk encryption.
Access Control
- Access to production systems is restricted to authorized personnel on a least-privilege basis.
- Multi-factor authentication (MFA) is enforced for administrative access.
- Access reviews are conducted regularly to ensure permissions remain appropriate.
Monitoring and Detection
- Security logs and system activity are continuously monitored.
- Intrusion detection and vulnerability monitoring tools are used to identify potential threats.
- Infrastructure and applications are regularly assessed for vulnerabilities.
Operational Security
- Security awareness training is provided to employees.
- Background checks are performed where permitted by law.
- Changes to production systems follow formal change-management procedures.
Data Governance
- Customer data is processed solely for the purpose of providing the PumpCX service.
- Data retention policies are applied according to operational and contractual requirements.
- Customer data can be deleted or exported in accordance with contractual obligations.
- A data classification policy governs how information is handled according to its sensitivity.
- Confidentiality and non-disclosure agreements are enforced across employees and sub-processors.
PumpCX maintains a formal security program aligned with industry standards and undergoes independent third-party assessments.
Data Residency
Data Residency
PumpCX infrastructure is hosted on Amazon Web Services (AWS) in secure cloud environments.
Customer data is stored and processed within PumpCX-managed cloud infrastructure. AWS provides physical, environmental, and network security controls that support the protection of customer data. The customer's data is retained in a single data storage location as agreed during onboarding.
Current Deployment Locations
Access Controls
Identity and Authentication
PumpCX enforces strong identity controls to protect access to systems and data.
- Multi-factor authentication (MFA) is required for administrative access.
- Access permissions follow the principle of least privilege.
- Access reviews are conducted regularly.
- Authentication and authorization controls protect access to production systems.
Resilience
Business Continuity
PumpCX maintains documented business continuity and disaster recovery plans designed to ensure service resilience and rapid recovery from operational disruptions.
Plans are tested periodically and reviewed as part of our security and compliance program.
- Documented business continuity and disaster recovery plans, tested at least annually.
- Infrastructure redundancy across availability zones.
- Continuous uptime monitoring — see System Status for current availability.
Testing
Security Testing
PumpCX regularly evaluates the security of its platform through:
- Independent third-party annual penetration testing
- Continuous vulnerability scanning
- Security reviews integrated into development workflows
Identified issues are tracked and remediated through formal engineering processes.
Overview
Security Program Overview
PumpCX maintains a comprehensive information security program designed to protect customer data and ensure the reliability and integrity of our services. Our security program is built around industry best practices and is supported by formal policies, technical safeguards, and ongoing monitoring.
The program covers governance, infrastructure security, application security, operational processes, and third-party risk management.
Governance and Compliance
PumpCX operates a formal information security program aligned with recognized industry standards. Security controls are continuously monitored and assessed as part of our compliance program.
Our security program includes:
- Documented security policies and procedures
- Defined roles and responsibilities for security governance
- Ongoing risk assessment and mitigation processes
- Continuous monitoring of security controls
- Independent third-party assessments and audits
PumpCX holds a SOC 2 Type 2 attestation report and a HIPAA attestation report, both issued by Sensiba LLP, and aligns its controls to ISO 27001:2022.
Infrastructure Security
PumpCX infrastructure is hosted within industry-leading cloud environments that provide strong physical and environmental protections.
Security controls include:
- Network isolation and segmentation
- Firewalls and access restrictions
- Infrastructure hardening
- Continuous monitoring of system activity
- Regular vulnerability assessments
Access to production systems is tightly restricted and managed according to the principle of least privilege.
Application Security
Security is integrated throughout the PumpCX software development lifecycle.
Our development practices include:
- Secure coding practices and internal development standards
- Peer code review for production changes
- Automated testing and security scanning
- Vulnerability management and patching processes
Security issues are tracked and remediated through formal engineering workflows.
Monitoring and Incident Response
PumpCX maintains monitoring systems designed to detect and respond to security events.
Key capabilities include:
- Centralized logging and monitoring
- Automated alerting for suspicious activity
- Documented incident response procedures
- Security event investigation and remediation processes
Our incident response program ensures that security events are evaluated, contained, and addressed in a timely manner.
Third-Party Risk Management
PumpCX evaluates third-party vendors that support our service delivery to ensure they meet appropriate security and privacy standards.
Vendors with access to customer data are assessed as part of our vendor risk management process and are listed in our Subprocessor Register.
Continuous Improvement
Security is an ongoing process. PumpCX regularly reviews and improves its security controls through:
- Independent penetration testing
- Continuous compliance monitoring
- Security control reviews
- Feedback from customers and security researchers
Our goal is to maintain a strong security posture while continuously improving the protection of our platform and customer data.
Personnel
Employee Security
Background Checks
All employees and contractors undergo background checks prior to joining PumpCX, where permitted by applicable law. Checks include identity verification, criminal history, and employment history validation.
Security Training
All new hires complete security awareness training within 14 days of their start date. Training covers data handling, phishing awareness, incident reporting, and acceptable use. Annual refresher training is mandatory for all staff.
Code of Conduct
All employees acknowledge and agree to PumpCX's Code of Conduct and Acceptable Use Policy upon hire. These policies set expectations for professional behavior, data handling responsibilities, and the consequences of non-compliance.
Offboarding
Upon departure, all system access is revoked within 24 business hours. Equipment is returned, credentials are deactivated, and access reviews confirm complete removal from all systems and services.
Artificial Intelligence
Responsible Use of AI
PumpCX uses artificial intelligence technologies to support certain product capabilities, including automated test generation, conversation analysis, and natural language processing. We are committed to responsible and secure use of AI systems.
Customer Data Protection
Customer data submitted to PumpCX is not used to train foundation models.
PumpCX uses the enterprise AI service Amazon Bedrock, which provides contractual assurances that prompts and model outputs are not used to train or improve the underlying models. Upon customer agreement, PumpCX also self-hosts AI services within AWS, which also are not used to train or improve the underlying models.
Customer data processed by AI services is used only for the purpose of generating responses requested by the customer.
Data Handling
When AI features are used:
- Customer prompts are processed only to generate the requested output
- Data is encrypted in transit and at rest
- Model responses are not retained by AI providers for training
PumpCX maintains strict controls to prevent unauthorized access to customer data processed by AI systems.
Human Oversight
AI-generated outputs are intended to assist users, not replace human judgment. Customers remain responsible for reviewing AI-generated outputs before relying on them in production environments.
Transparency
PumpCX will clearly identify product features that use AI technologies and will continue to evolve our governance practices as AI technology and regulatory expectations develop.
Framework Mapping
Compliance Coverage
See how PumpCX's security controls map to SOC 2 Trust Service Criteria, HIPAA safeguard requirements, and ISO 27001 Annex A controls.
SOC 2 Trust Service Criteria
Our SOC 2 Type 2 examination covers the Security category (Common Criteria). The mapping below shows how our controls align with CC1–CC9.
| Criteria | Description | PumpCX Controls |
|---|---|---|
| CC1 – Control Environment | Organizational commitment to integrity and security | Security governance, policies & procedures, employee training, background checks |
| CC2 – Communication & Information | Internal and external security communication | Security awareness training, Trust Center, incident communication procedures |
| CC3 – Risk Assessment | Identification and analysis of risks | Risk assessments, vulnerability scanning, penetration testing, vendor risk management |
| CC4 – Monitoring Activities | Ongoing evaluation of controls | Continuous compliance monitoring (Vanta), security control reviews, audit logging |
| CC5 – Control Activities | Policies and procedures to mitigate risks | Change management, code reviews, infrastructure security controls, automated deployments |
| CC6 – Logical & Physical Access | Access restrictions to systems and data | MFA, least-privilege access, access reviews, encryption at rest (AES-256) & in transit (TLS 1.2+) |
| CC7 – System Operations | Detection and response to anomalies | IDS, centralized logging, vulnerability assessments, incident response procedures |
| CC8 – Change Management | Controlled changes to infrastructure and software | Version control, code reviews, automated CI/CD pipelines, change approval processes |
| CC9 – Risk Mitigation | Risk mitigation through business processes | Vendor management, insurance, business associate agreements, contractual safeguards |
HIPAA Safeguards
| Safeguard | Requirement | PumpCX Controls |
|---|---|---|
| Administrative Safeguards (§164.308) | ||
| Security Management | Policies to prevent, detect, contain, and correct security violations | Risk assessments, security policies, Vanta continuous monitoring, vulnerability management |
| Assigned Security Responsibility | Designated security official | Designated security officer, defined security roles and responsibilities |
| Workforce Security | Appropriate access for workforce members | Background checks, onboarding/offboarding procedures, least-privilege access |
| Information Access Management | Authorized access to ePHI | Role-based access control, access reviews, least-privilege enforcement |
| Security Awareness & Training | Security awareness program for workforce | Security awareness training, phishing simulations, ongoing education |
| Security Incident Procedures | Incident identification, response, and mitigation | Incident response plan, IDS, centralized logging, post-incident reviews |
| Contingency Plan | Data backup, disaster recovery, and emergency operations | Business continuity & disaster recovery plans, data backups, periodic plan testing |
| Evaluation | Periodic technical and non-technical evaluation | Annual penetration testing, security control reviews, SOC 2 audits |
| Business Associate Agreements | Contracts with business associates handling ePHI | BAA execution and management, vendor risk assessments, subprocessor oversight |
| Physical Safeguards (§164.310) | ||
| Facility Access Controls | Physical access limitations to facilities | AWS data center physical security (independent SOC 2 examination), no on-premise data storage |
| Workstation & Device Security | Workstation use policies and device controls | Endpoint security policies, device encryption, remote wipe capabilities |
| Technical Safeguards (§164.312) | ||
| Access Control | Technical policies limiting access to ePHI | MFA, unique user IDs, automatic session timeouts, role-based access |
| Audit Controls | Recording and examination of system activity | Centralized audit logging, log monitoring, access activity tracking |
| Integrity Controls | Protection of ePHI from improper alteration or destruction | Data validation, checksums, version control, database integrity checks |
| Transmission Security | Protection of ePHI during electronic transmission | TLS 1.2+ encryption in transit, encrypted API communications, secure file transfers |
ISO 27001:2022 Annex A Controls
PumpCX is not currently ISO 27001 certified. The mapping below shows how our existing security controls align with ISO 27001:2022 Annex A domains.
| Control Domain | Objective | PumpCX Controls |
|---|---|---|
| Organisational Controls (A.5) | ||
| A.5.1 – Policies for Information Security | Management direction and support for information security | Documented security policies, annual policy reviews, management-approved security program |
| A.5.2–5.6 – Roles & Responsibilities | Defined security roles, segregation of duties, management responsibilities | Designated security officer, defined roles and responsibilities, segregation of duties in production access |
| A.5.7 – Threat Intelligence | Collection and analysis of threat information | Vulnerability scanning, AWS security advisories, continuous compliance monitoring via Vanta |
| A.5.10–5.14 – Information Handling | Classification, labelling, transfer, and deletion of information | Data classification policy, encryption in transit (TLS 1.2+) & at rest (AES-256), data retention & deletion procedures |
| A.5.15–5.18 – Access Control | Access policies, identity management, authentication, access rights | RBAC, least-privilege access, MFA for all privileged access, quarterly access reviews, 24-hour offboarding revocation |
| A.5.19–5.22 – Supplier Relationships | Security in supplier agreements and monitoring | Vendor security due diligence, contractual data protection obligations, annual vendor reviews, subprocessor oversight |
| A.5.24–5.28 – Incident Management | Incident response planning, reporting, and learning | Documented incident response plan, IDS, centralized logging, post-incident reviews, breach notification procedures |
| A.5.29–5.30 – Business Continuity | ICT readiness and continuity planning | BC/DR plans, 1-hour RTO, daily backups with 14-day retention, annual DR testing, telephony failover |
| A.5.31–5.36 – Compliance | Legal, regulatory, and contractual requirements | SOC 2 compliance, HIPAA safeguards, privacy policy, data residency controls, independent audits |
| People Controls (A.6) | ||
| A.6.1 – Screening | Background verification prior to employment | Background checks (identity, criminal, employment history) for all employees and contractors |
| A.6.2 – Terms & Conditions | Employment agreements with security responsibilities | Code of Conduct, Acceptable Use Policy, confidentiality agreements acknowledged upon hire |
| A.6.3 – Awareness & Training | Security awareness education and training | Security training within 14 days of hire, annual refresher training, secure development training |
| A.6.5 – Termination Responsibilities | Security duties upon termination or change of employment | Access revoked within 24 business hours, equipment return, credential deactivation, access review confirmation |
| Physical Controls (A.7) | ||
| A.7.1–7.4 – Physical Security | Physical security perimeters, entry controls, and monitoring | AWS data center physical security (independent SOC 2 examination), no on-premise data storage |
| A.7.9–7.14 – Asset Security | Security of assets off-premises, storage media, and equipment | Endpoint security policies, device encryption, remote wipe capabilities, secure media disposal |
| Technological Controls (A.8) | ||
| A.8.1–8.5 – Endpoint & Access | User devices, privileged access, and source code security | Endpoint protection, MFA, privileged access management, source code in version control with access controls |
| A.8.7–8.8 – Malware & Vulnerabilities | Protection against malware and management of technical vulnerabilities | Endpoint protection, continuous vulnerability scanning, annual penetration testing, 30-day critical remediation SLA |
| A.8.9–8.10 – Configuration & Data | Configuration management and data handling | Infrastructure as code, automated deployments, data classification, retention & deletion policies |
| A.8.15–8.16 – Logging & Monitoring | Logging of activities and monitoring of anomalies | Centralized audit logging, activity tracking, IDS, 30-day log retention minimum |
| A.8.20–8.22 – Network Security | Network controls, segmentation, and web filtering | AWS VPC network segmentation, security groups, WAF, TLS enforcement |
| A.8.24–8.28 – Cryptography & Development | Use of cryptography, secure development lifecycle, and testing | AES-256 at rest, TLS 1.2+ in transit, secure SDLC, code reviews, change management, environment segregation |
Third Parties
Sub-Processors
The following third-party vendors process data on behalf of PumpCX.
| Vendor | Purpose |
|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting and data storage |
| Atlassian (Jira) | Customer issue tracking and support ticket management |
| Microsoft (Office 365 / Exchange Online) | Email delivery and communication |
| Vanta | Security compliance monitoring |
Subprocessor changes will be communicated to customers 30 days in advance.
Payment Card Data
PCI DSS
PCI DSS Scope
PumpCX is a telephony assurance platform and is not designed to process payment transactions.
PumpCX does not store, process, or transmit payment card data (cardholder data) as part of its normal operation and therefore falls outside the scope of PCI DSS.
Use of Payment Test Cases
Some customer test scenarios may simulate payment workflows (for example IVR credit card balance checks).
For these scenarios:
- •Customers should use synthetic or test card numbers only
- •Synthetic or test card numbers can be further protected within the platform by utilizing PumpCX secrets and private test cases
- •PumpCX does not require or request real payment card numbers
Card Number Detection and Redaction
To prevent accidental storage of cardholder data, PumpCX implements automated safeguards including:
- •Detection of card number patterns
- •Luhn checksum validation
- •Automatic masking or redaction in logs and transcripts
These controls are designed to ensure that potential card numbers are not stored within the PumpCX platform.
Customer Responsibility
Customers are responsible for ensuring that real payment card data is not submitted to the PumpCX platform unless explicitly supported by a PCI DSS validated payment environment.
Availability
System Status
FAQ
Security FAQ
Where is customer data stored?
PumpCX infrastructure is hosted on Amazon Web Services (AWS) across multiple availability zones. Customer data is stored in a single region as agreed during onboarding. Current deployment regions include Australia (Sydney), Canada (Central), and United States (Oregon).
How is data encrypted?
Data is encrypted in transit using TLS 1.2 or higher. Data is encrypted at rest using AES-256 via AWS-managed disk encryption. All encryption follows NIST SP 800-57 standards. Encryption keys are rotated annually.
How is access to customer data controlled?
Access is managed using role-based access control (RBAC) following the principle of least privilege. Multi-factor authentication (MFA) is required for all privileged access to production infrastructure. Access reviews are conducted quarterly, and access is revoked within 24 business hours of employee or contractor departure.
Do you perform penetration testing?
Yes. PumpCX undergoes annual independent third-party penetration testing, as well as continuous vulnerability scanning. Public-facing vulnerability scans are performed at least quarterly. Critical and high severity vulnerabilities are remediated within 30 days of discovery.
Do you monitor security controls continuously?
Yes. Controls are continuously monitored via our compliance platform. PumpCX maintains centralized logging, intrusion detection, and security event investigation. User activity logs including login/logout, data operations, and administrative actions are retained for at least 30 days.
What is your incident response process?
PumpCX maintains a documented incident response plan covering incident identification, containment, evidence gathering, notification, and remediation. For incidents involving protected health information (PHI), affected Covered Entities are notified within 60 days in accordance with the HIPAA Breach Notification Rule. All security incidents should be reported to security@pump.cx.
How long is customer data retained?
Data retention policies are applied according to operational and contractual requirements. Upon contract termination, customer data is deleted within 60 days. Personal information is deleted or de-identified as soon as it no longer has a business use, or in response to a verified data subject request.
Can customer data be deleted on request?
Yes. Personal information will be deleted in response to a verified request from a customer or data subject, unless there is a legal obligation to retain it. Customer data can also be exported in accordance with contractual obligations.
Do you use customer data to train AI models?
No. PumpCX does not use customer data to train AI or machine learning models. Our AI services, including Amazon Bedrock, provide contractual assurances that data is not used for model training. See the AI & Data Usage section for full details.
How is test data handled?
Confidential customer data is not used in development or testing environments without explicit permission from the data owner and the CTO. When approved, data must be scrubbed of sensitive information whenever feasible. Development, testing, and production environments are logically or physically segregated.
What is your disaster recovery capability?
PumpCX maintains documented business continuity and disaster recovery plans. Production services have a recovery time objective (RTO) of 1 hour. Infrastructure is backed up daily with a 14-day snapshot history, stored separately from production. DR plans are tested annually, including backup restoration. Telephony carrier links are highly available with automatic failover.
Do you have a BAA for HIPAA?
Yes. PumpCX will enter into a Business Associate Agreement (BAA) where required. Customers handling protected health information (PHI) can review and accept a BAA through the Reports section of this Trust Center.
Can I get a copy of your SOC 2 report?
Yes. SOC 2 and other compliance reports are available through the Reports section of this Trust Center. Access requires registration with a business email and execution of a mutual NDA to protect the confidentiality of the report contents.
How do you manage third-party vendors?
All third parties with access to confidential data undergo security due diligence before engagement, including evaluation against applicable standards such as ISO 27001, SOC 2, and GDPR. Written agreements are required acknowledging data confidentiality responsibilities. Vendor security and service delivery performance is reviewed at least annually.
How is your software developed securely?
PumpCX follows secure-by-design and privacy-by-design principles. All significant code changes are reviewed and approved before deployment to production. Developers receive secure development training at least annually. Source code is managed in version control with full history for rollback, and application vulnerabilities that materially impact security are patched within 90 days of discovery.
How do you vet employees?
All employees undergo background checks prior to hire, complete security awareness training within 14 days of joining, and receive mandatory annual refresher training. See the Employee Security section for full details on our personnel security program.
Contact
Security Contact
PumpCX welcomes security-related questions from customers, partners, and researchers.
For security concerns, vulnerability reports, or inquiries regarding our security program, please contact:
security@pump.cxOur security team reviews all submissions and will respond as appropriate.
For general support or product inquiries, please use our standard customer support channels.
Vulnerability Reporting
Responsible Disclosure
PumpCX supports responsible disclosure of security vulnerabilities.
If you believe you have discovered a security issue affecting PumpCX systems or services, please report it to our security team at security@pump.cx
When submitting a report, please include:
- •A description of the vulnerability
- •Steps to reproduce the issue
- •Any relevant supporting information
We request that researchers:
- •Avoid accessing or modifying customer data
- •Refrain from actions that could disrupt service availability
- •Allow reasonable time for investigation and remediation before public disclosure
PumpCX investigates all legitimate reports and works to resolve confirmed issues in a timely manner.
PumpCX appreciates the efforts of the security research community in helping keep our systems secure.
Request the SOC 2 report
Register with your business email and sign our NDA to access and download SOC 2 reports, penetration test results, Security Architecture Overview, HIPAA Compliance Overview & Business Associate Agreement.
Register for Access