Security at Sixtyfour

Security you can verify

Sixtyfour is SOC 2 Type 2 compliant. Our controls protect the data you send us, the platform that runs your research, and the people that research is about.

Request the SOC 2 report See our controls

Platform security

Controls that protect every request

The safeguards around the data you send us and the systems that process it.

Encrypted in transit and at rest

Your data travels over TLS, and our production databases are encrypted at rest with AES-256.

Backed up every day

We back up production databases daily and test restoring them twice a year.

MFA on privileged access

Multi-factor authentication is enforced on every privileged account and on access to critical systems.

Least privilege by default

Each role gets the minimum access it needs, and we review access rights every quarter.

Traceable production access

Every connection to production uses a uniquely identified account over SSH, TLS or VPN.

Penetration tested every year

An external firm penetration tests our production environment at least once a year.

Responsible data

Careful with the people we research

Sixtyfour researches people and companies, so how we collect and keep that data matters as much as how we secure it.

What we collect: Public sources only; We collect professional data only from publicly accessible sources.
How we use it: Never for training; Your data is used to deliver the service you asked for. We do not use it to train AI models.
How long we keep it: 12 months at most; Every profile we collect is deleted within 12 months of collection.
Who can ask: Anyone; Anyone can send a privacy request about their personal data through our compliance portal and follow its progress.; Send a privacy request

Compliance portal

Everything your security review needs

Our SOC 2 Type 2 report, policies and data processing agreement live in our compliance portal. Public documents open straight away, and the rest are shared on request.

Open the compliance portal

Shared on request

Request access in the portal

SOC 2 Type 2 reportThe independent audit of our security controls. Data processing agreementOur template DPA, ready for your legal review. Security policies12 policies The policies our security program is built on.

Access control
Asset management
Business continuity, backup and recovery
Code of conduct
Cookies and tracking technologies
Data management
Human resource security
Information security
Operations security
Risk management
Secure development
Third-party

Open to everyone

No request needed

SubprocessorsThe services that process data on our behalf, and where. Privacy policyHow we collect, use and protect personal data.

Found a security issue?

We want to hear about it. Email us the details and the steps to reproduce it. Reports go straight to our security team.

Report a vulnerability

security@sixtyfour.ai