Compliance statement

1. Certifications held

As of the date above, Encased holds no formal third-party security certifications or attestation reports (including SOC 2, ISO/IEC 27001 or ISO/IEC 42001). We will update this statement when any is issued, and will never describe Encased as certified before it is.

2. Certifications in progress

• SOC 2 Type II — in preparation.
• ISO/IEC 27001 — planned.
• ISO/IEC 42001 and an independent penetration test — planned.

3. Privacy

We handle personal information in line with the Australian Privacy Principles under the Privacy Act 1988 (Cth). We collect only what is needed to run the service and respond to inquiries, and do not sell personal information. GDPR and CCPA readiness (data processing agreement, sub-processor list) is planned.

4. Data location and sub-processors

Encased runs on managed cloud infrastructure with a global edge network. Sub-processors include our cloud hosting and database provider, our email delivery provider and Stripe for payments. Enterprise customers can run the gateway on their own servers so agent actions never leave their network.

5. Availability

No formal uptime guarantee (SLA) is offered at this time. A 99.9% monthly target with a public status page is planned for Enterprise plans.

6. Incident notification

If we become aware of a data breach affecting your data, we will notify you without undue delay and, where required, the Office of the Australian Information Commissioner under the Notifiable Data Breaches scheme.

7. Requesting evidence

Customers and prospects can request our security questionnaire responses and architecture overview by email.