SOC 2 Type II Certified

Patch’s  SOC 2 Type II report includes the trust services categories of Security, Confidentiality, and Availability, and is audited annually.

HIPAA Compliance

Patch is HIPAA compliant.

GDPR Compliance

Patch is GDPR Compliant.

CCPA Compliance

Patch is CCPA Compliant.

Secure infrastructure provider

We host all of our data in physically secure, U.S.-based leading cloud provider facilities that include 24/7 on-site security, camera surveillance, and more.

Strict access controls

Access to all Patch systems is managed through our identity provider, which automates user provisioning, enforces passwordless MFA, and logs all activity.

Server security & monitoring

All servers are configured using a documented set of security guidelines, and images are managed centrally. Changes to the company’s infrastructure are tracked, and security events are logged appropriately.

Formal security policies and incident response plan

Patch maintains a set of comprehensive security polices that are kept up to date to meet the changing security environment. These materials are made available to all employees during training and through the company’s knowledge base.

Continuous security training

Patch provides continuous education on emerging security threats, performs phishing awareness campaigns, and communicates with employees regularly.

Development and change management process

Code development is done through a documented SDLC process, and every change is tracked via GitHub. Automated controls ensure changes are peer-reviewed and pass a series of tests before being deployed to production.

Third-party vendor security review process

We ensure that all of our third-party apps and providers meet our security data protection standards before using them.