Security and trust, built in from the start
Every organization that evaluates ThirdPartyIQ will assess us the way they assess any other third party, and they should. We designed the platform for that scrutiny from day one: audited hosting, a named human approving every decision, and a record behind every output. Here is how it is built and where our compliance program is headed.
Design decisions, not commitments for later
The way a platform handles your data is decided in its architecture long before it is described in a policy. These are the choices already in the product.
Hosted on independently audited infrastructure
ThirdPartyIQ runs on Microsoft Azure, which carries its own SOC 2 Type 2 attestation covering the infrastructure beneath the platform.
Your data stays yours
We collect third-party documentation on your authority and on your behalf. Your program data, your control library, and the evidence we assemble for you belong to you. We do not sell them and we do not share them.
Nothing acts on your program without approval
AI recommends. Humans approve. Nothing becomes a work product, a risk rating, or a submitted document without a named person approving it, which contains the consequences of a model error by design rather than by policy.
Every output traceable to its source
Each finding carries the document, page, and passage it came from, and each action carries the record of what triggered it and who approved it. The same audit trail that satisfies your reviewer is what lets you verify our work.
Building to the standard our customers are held to
Our customers are examined on how well they oversee their third parties. We are one of them, so we are building our own program to the same standard, on this timeline.
-
By design
Built to the SOC 2 criteria
The platform is being built against the SOC 2 Trust Services Criteria rather than adapted to them later, with a compliance platform running continuous control monitoring and evidence collection.
-
Q4 2026
Controls operating at launch
The control set is implemented and operating when the platform goes live, so the security posture arrives with the product instead of trailing it.
-
Early 2027
Independent attestation
Our SOC 2 Type II attestation is targeted for early 2027, following the observation period and the audit. We will publish its availability here and provide the report under NDA on request.
Ask us the questions you would ask any third party
We answer security diligence directly and in writing rather than pointing at a badge. We will complete your questionnaire, walk your security team through our architecture, and put commitments in the contract where you need them there.
The topics below are the ones we are asked about most. If your program covers something not on this list, ask anyway.
Commonly requested
- Encryption in transit and at rest
- Authentication, SSO, and access control
- Penetration testing and vulnerability management
- Subprocessors and data residency
- Data retention and deletion
- Incident response and breach notification
- Business continuity and disaster recovery
- AI model governance and data usage
Found something, or need something?
For security questions, diligence requests, or to report a suspected vulnerability, write to us directly. We acknowledge security reports within one business day, and we will not pursue action against researchers who report in good faith and give us reasonable time to respond.
info@thirdpartyiq.com