Independent review
We complete a SOC 2 Type II audit against the AICPA Trust Services Criteria for security, availability, and confidentiality. We monitor our environments and review our controls as the product changes.
ReportThe 2026 State of TPRMThe 2026 State of TPRM: where programs break and what risk leaders want insteadDownload
We hold our security to the standard you hold your vendors to.
We protect the supplier records and evidence you trust us with. Here's how we test our controls, restrict access, and safeguard your data.
Protect the evidence behind every decision.
We handle the supplier records, contracts, and security evidence you use to make consequential decisions. That means our own controls need to stand up to scrutiny.
Our program covers independent review, testing, access controls, encryption, and accountability. If your team needs documentation for a security review, ask us directly.
How we protect your data.
These are the practices we put behind your supplier records and evidence.
Testing and remediation
We commission external penetration tests every year, and run vulnerability scans plus static and dynamic application security tests. We track findings through remediation.
Identity and production access
We support SAML-based SSO with Okta, Microsoft Entra ID, Google, and other identity providers. We require multi-factor authentication for production access.
Data protection and privacy
We encrypt data at rest with AES-256 and in transit with TLS 1.2 or higher. We handle requests to exercise rights under GDPR and CCPA through our privacy processes.
Internal accountability
We log access to systems and data, review least-privilege access quarterly, and require employee security and privacy training. We don't store customer data on employee devices.
Our founders own this commitment.
We built Coverbase for teams that have to trust the evidence in front of them. We hold our own security program to that same standard.
Co-founder and CEO
Co-founder and CTO
Security questions or a vulnerability?
Write to us for current security documentation or to report a vulnerability.
Ask us what happens to your data.
Our security team answers questions about how Coverbase stores, accesses, and protects customer data.