Trust & Security

SOC 2 Type II

AMP Cortex is built and operated against the AICPA Trust Services Criteria for Security, Availability, and Confidentiality. The controls below are the ones the platform runs today, and the Type II attestation that covers them is in progress.

Where the attestation stands: AMP Cortex is SOC 2 Type II ready, not yet attested. The control program described on this page is live and the observation window is running, but no report has been issued, so there is none to show you. If your procurement requires an attested provider today, tell us and we will say so plainly rather than let it surface halfway through diligence.

Security: Protection against unauthorized access, both physical and logical.
Availability: Engineered against the availability commitments in the plan SLAs, up to 99.99% on Professional.
Confidentiality: Customer communications data is protected through its full lifecycle.

Continuous monitoring

Controls are monitored continuously through automated evidence collection, with quarterly internal reviews. The independent audit by a licensed CPA firm is the step in progress. Exceptions and remediations are tracked to closure with executive oversight.

Infrastructure

The platform runs in US data centers in Texas, Virginia and Oregon, with call routing designed to survive the loss of any one site. Signaling and media are encrypted in transit with TLS and SRTP; customer data is encrypted at rest with AES-256, and key material is stored encrypted rather than in plaintext. Tenants are isolated from one another in the database by row-level security, not by application filtering alone.

Access control

Production access requires hardware-key MFA, is granted least-privilege by role, reviewed quarterly, and logged immutably. Support access to customer accounts requires customer consent and is time-boxed and audited.

Vendor management

Subprocessors are risk-assessed before onboarding and reviewed annually. Carriers and infrastructure providers must maintain SOC 2 or equivalent attestations.

Incident response

A 24/7 on-call security team operates a documented incident response plan, tested twice yearly through tabletop and live exercises. Customer-impacting incidents are disclosed per contractual and regulatory timelines, with post-incident reports published to affected customers.

Doing vendor diligence? Ask for the current control documentation and the attestation timeline under NDA at [email protected] with “SOC 2” in the subject line. Covered entities should start with the Business Associate Agreement, which is signed at no extra charge on Professional and Enterprise.