Tested. Trusted. Assured.
PumpCX Trust Center
Transparency into PumpCX's security practices, compliance certifications, and the controls that protect customer data. Access audit reports by registering below.
Compliance
Our Certifications
PumpCX maintains industry-leading certifications to ensure your data is handled with the highest standards of security and privacy.
SOC 2 Type II
ActiveAudited Nov 2025
Service Organization Control 2 — Trust Services Criteria for Security, Availability, and Confidentiality.
HIPAA
In ProgressHealth Insurance Portability and Accountability Act — safeguarding protected health information (PHI).
Hover over a certification for details
Independent security assessments validate PumpCX's controls and compliance. Access full audit reports and penetration test summaries by registering below.
HIPAA & Business Associate Agreements
PumpCX supports HIPAA-compliant deployments and will enter into a Business Associate Agreement (BAA) with customers handling Protected Health Information (PHI). The BAA is available for signing via the Reports page.
Need our compliance reports?
Register with your business email and sign our NDA to access and download SOC 2 reports, penetration test results, Security Architecture Overview, HIPAA Compliance Overview & Business Associate Agreement.
Register for AccessSecurity
Data Protection Overview
Protecting customer data is fundamental to PumpCX's platform design and operations.
PumpCX applies a defense-in-depth approach to safeguard customer data across infrastructure, application, and operational layers. Security controls are continuously monitored and regularly reviewed as part of our compliance and security program.
Encryption
- All data is encrypted in transit using TLS 1.2 or higher (TLS 1.3 preferred).
- Customer data stored on AWS storage volumes is encrypted at rest using AES-256 disk encryption.
Access Control
- Access to production systems is restricted to authorized personnel on a least-privilege basis.
- Multi-factor authentication (MFA) is enforced for administrative access.
- Access reviews are conducted regularly to ensure permissions remain appropriate.
Monitoring and Detection
- Security logs and system activity are continuously monitored.
- Intrusion detection and vulnerability monitoring tools are used to identify potential threats.
- Infrastructure and applications are regularly assessed for vulnerabilities.
Operational Security
- Security awareness training is provided to employees.
- Background checks are performed where permitted by law.
- Changes to production systems follow formal change-management procedures.
Data Governance
- Customer data is processed solely for the purpose of providing the PumpCX service.
- Data retention policies are applied according to operational and contractual requirements.
- Customer data can be deleted or exported in accordance with contractual obligations.
PumpCX maintains a formal security program aligned with industry standards and undergoes independent third-party assessments.
Data Residency
Data Residency
PumpCX infrastructure is hosted on Amazon Web Services (AWS) in secure cloud environments.
Customer data is stored and processed within PumpCX-managed cloud infrastructure. AWS provides physical, environmental, and network security controls that support the protection of customer data. The customer's data is retained in a single data storage location as agreed during onboarding.
Current Deployment Locations
Access Controls
Identity and Authentication
PumpCX enforces strong identity controls to protect access to systems and data.
- Multi-factor authentication (MFA) is required for administrative access.
- Access permissions follow the principle of least privilege.
- Access reviews are conducted regularly.
- Authentication and authorization controls protect access to production systems.
Resilience
Business Continuity
PumpCX maintains documented business continuity and disaster recovery plans designed to ensure service resilience and rapid recovery from operational disruptions.
Plans are tested periodically and reviewed as part of our security and compliance program.
Testing
Security Testing
PumpCX regularly evaluates the security of its platform through:
- Independent third-party annual penetration testing
- Continuous vulnerability scanning
- Security reviews integrated into development workflows
Identified issues are tracked and remediated through formal engineering processes.
Overview
Security Program Overview
PumpCX maintains a comprehensive information security program designed to protect customer data and ensure the reliability and integrity of our services. Our security program is built around industry best practices and is supported by formal policies, technical safeguards, and ongoing monitoring.
The program covers governance, infrastructure security, application security, operational processes, and third-party risk management.
Governance and Compliance
PumpCX operates a formal information security program aligned with recognized industry standards. Security controls are continuously monitored and assessed as part of our compliance program.
Our security program includes:
- Documented security policies and procedures
- Defined roles and responsibilities for security governance
- Ongoing risk assessment and mitigation processes
- Continuous monitoring of security controls
- Independent third-party assessments and audits
PumpCX maintains compliance with recognized security frameworks including SOC 2 and HIPAA.
Infrastructure Security
PumpCX infrastructure is hosted within industry-leading cloud environments that provide strong physical and environmental protections.
Security controls include:
- Network isolation and segmentation
- Firewalls and access restrictions
- Infrastructure hardening
- Continuous monitoring of system activity
- Regular vulnerability assessments
Access to production systems is tightly restricted and managed according to the principle of least privilege.
Application Security
Security is integrated throughout the PumpCX software development lifecycle.
Our development practices include:
- Secure coding practices and internal development standards
- Peer code review for production changes
- Automated testing and security scanning
- Vulnerability management and patching processes
Security issues are tracked and remediated through formal engineering workflows.
Monitoring and Incident Response
PumpCX maintains monitoring systems designed to detect and respond to security events.
Key capabilities include:
- Centralized logging and monitoring
- Automated alerting for suspicious activity
- Documented incident response procedures
- Security event investigation and remediation processes
Our incident response program ensures that security events are evaluated, contained, and addressed in a timely manner.
Third-Party Risk Management
PumpCX evaluates third-party vendors that support our service delivery to ensure they meet appropriate security and privacy standards.
Vendors with access to customer data are assessed as part of our vendor risk management process and are listed in our Subprocessor Register.
Continuous Improvement
Security is an ongoing process. PumpCX regularly reviews and improves its security controls through:
- Independent penetration testing
- Continuous compliance monitoring
- Security control reviews
- Feedback from customers and security researchers
Our goal is to maintain a strong security posture while continuously improving the protection of our platform and customer data.
Controls
Security Controls
PumpCX maintains a comprehensive set of security controls that are continuously monitored as part of our compliance program.
Infrastructure Security
6/6 passing- Service infrastructure maintained
- Remote access MFA enforced
- Unique production database authentication
+ 3 more controls
Organizational Security
4/4 passing- Employee background checks performed
- Security awareness training implemented
- Confidentiality agreement acknowledged
+ 1 more controls
Internal Security Procedures
4/4 passing- Vulnerabilities scanned and remediated
- Continuity and disaster recovery plans tested
- Incident response plan tested
+ 1 more controls
Product Security
3/3 passing- Penetration testing performed
- Vulnerability and system monitoring
- Secure SDLC implemented
Data And Privacy
4/4 passing- Privacy policy established
- Data retention procedures established
- Privacy compliant procedures established
+ 1 more controls
Ai Security & Compliance
3/3 passing- AI system impact assessment
- AI management scope defined
- AI objectives and planning
24 of 24 controls passing — updated less than 1 minute ago via Vanta.
Framework Mapping
Compliance Coverage
See how PumpCX's security controls map to SOC 2 Trust Service Criteria and HIPAA safeguard requirements.
🛡️ SOC 2 Trust Service Criteria
| Criteria | Description | PumpCX Controls |
|---|---|---|
| CC1 – Control Environment | Organizational commitment to integrity and security | Security governance, policies & procedures, employee training, background checks |
| CC2 – Communication & Information | Internal and external security communication | Security awareness training, Trust Center, incident communication procedures |
| CC3 – Risk Assessment | Identification and analysis of risks | Risk assessments, vulnerability scanning, penetration testing, vendor risk management |
| CC4 – Monitoring Activities | Ongoing evaluation of controls | Continuous compliance monitoring (Vanta), security control reviews, audit logging |
| CC5 – Control Activities | Policies and procedures to mitigate risks | Change management, code reviews, infrastructure security controls, automated deployments |
| CC6 – Logical & Physical Access | Access restrictions to systems and data | MFA, least-privilege access, access reviews, encryption at rest (AES-256) & in transit (TLS 1.2+) |
| CC7 – System Operations | Detection and response to anomalies | IDS, centralized logging, vulnerability assessments, incident response procedures |
| CC8 – Change Management | Controlled changes to infrastructure and software | Version control, code reviews, automated CI/CD pipelines, change approval processes |
| CC9 – Risk Mitigation | Risk mitigation through business processes | Vendor management, insurance, business associate agreements, contractual safeguards |
| Availability | System availability for operation and use | Business continuity & disaster recovery plans, infrastructure redundancy, uptime monitoring |
| Confidentiality | Protection of confidential information | Encryption (AES-256 / TLS 1.2+), access controls, data classification, NDA enforcement |
🏥 HIPAA Safeguards
| Safeguard | Requirement | PumpCX Controls |
|---|---|---|
| Administrative Safeguards (§164.308) | ||
| Security Management | Policies to prevent, detect, contain, and correct security violations | Risk assessments, security policies, Vanta continuous monitoring, vulnerability management |
| Assigned Security Responsibility | Designated security official | Designated security officer, defined security roles and responsibilities |
| Workforce Security | Appropriate access for workforce members | Background checks, onboarding/offboarding procedures, least-privilege access |
| Information Access Management | Authorized access to ePHI | Role-based access control, access reviews, least-privilege enforcement |
| Security Awareness & Training | Security awareness program for workforce | Security awareness training, phishing simulations, ongoing education |
| Security Incident Procedures | Incident identification, response, and mitigation | Incident response plan, IDS, centralized logging, post-incident reviews |
| Contingency Plan | Data backup, disaster recovery, and emergency operations | Business continuity & disaster recovery plans, data backups, periodic plan testing |
| Evaluation | Periodic technical and non-technical evaluation | Annual penetration testing, security control reviews, SOC 2 audits |
| Business Associate Agreements | Contracts with business associates handling ePHI | BAA execution and management, vendor risk assessments, subprocessor oversight |
| Physical Safeguards (§164.310) | ||
| Facility Access Controls | Physical access limitations to facilities | AWS data center physical security (SOC 2 certified), no on-premise data storage |
| Workstation & Device Security | Workstation use policies and device controls | Endpoint security policies, device encryption, remote wipe capabilities |
| Technical Safeguards (§164.312) | ||
| Access Control | Technical policies limiting access to ePHI | MFA, unique user IDs, automatic session timeouts, role-based access |
| Audit Controls | Recording and examination of system activity | Centralized audit logging, log monitoring, access activity tracking |
| Integrity Controls | Protection of ePHI from improper alteration or destruction | Data validation, checksums, version control, database integrity checks |
| Transmission Security | Protection of ePHI during electronic transmission | TLS 1.2+ encryption in transit, encrypted API communications, secure file transfers |
Third Parties
Sub-Processors
The following third-party vendors process data on behalf of PumpCX.
| Vendor | Purpose |
|---|---|
| Amazon Web Services (AWS) | Infrastructure hosting and data storage |
| Atlassian (Jira) | Customer issue tracking and support ticket management |
| Microsoft (Office 365 / Exchange Online) | Email delivery and communication |
| Vanta | Security compliance monitoring |
Subprocessor changes will be communicated to customers 30 days in advance.
FAQ
Security FAQ
Where is customer data stored?
PumpCX infrastructure is hosted on AWS.
How is data encrypted?
Data is encrypted in transit using TLS 1.2+. Data is encrypted at rest using AWS-managed disk encryption with AES-256.
Do you perform penetration testing?
Yes. PumpCX undergoes annual independent third-party penetration testing.
Do you monitor security controls continuously?
Yes. Controls are continuously monitored via our compliance platform.
Contact
Security Contact
PumpCX welcomes security-related questions from customers, partners, and researchers.
For security concerns, vulnerability reports, or inquiries regarding our security program, please contact:
security@pump.cxOur security team reviews all submissions and will respond as appropriate.
For general support or product inquiries, please use our standard customer support channels.
Vulnerability Reporting
Responsible Disclosure
PumpCX supports responsible disclosure of security vulnerabilities.
If you believe you have discovered a security issue affecting PumpCX systems or services, please report it to our security team at security@pump.cx
When submitting a report, please include:
- •A description of the vulnerability
- •Steps to reproduce the issue
- •Any relevant supporting information
We request that researchers:
- •Avoid accessing or modifying customer data
- •Refrain from actions that could disrupt service availability
- •Allow reasonable time for investigation and remediation before public disclosure
PumpCX investigates all legitimate reports and works to resolve confirmed issues in a timely manner.
PumpCX appreciates the efforts of the security research community in helping keep our systems secure.
Need our compliance reports?
Register with your business email and sign our NDA to access and download SOC 2 reports, penetration test results, Security Architecture Overview, HIPAA Compliance Overview & Business Associate Agreement.
Register for Access