Trust Center
Our internal audits are complete in Scrut.io, and we're awaiting the final third-party audit for SOC 2, ISO 27001, and ISO 42001. This page tells you exactly where each certification stands, lists every sub-processor that touches customer data, and gives your security team a direct line.
Direct contact: security@pyramyd.ai · Legal: legal@pyramyd.ai
Audit status
No certification is issued yet. Our internal audits are complete in Scrut.io — each item below shows what's in place and what remains before the final third-party audit.
Controls are implemented and continuously monitored in Scrut.io, and our internal audit is complete. We are awaiting the final independent third-party audit that issues the SOC 2 report. Current status is available under NDA through our Trust Center.
Our ISMS is implemented and evidenced in Scrut.io, and the internal audit is complete. We are awaiting the Stage 2 certification audit by an accredited third-party body.
Our AI management system controls are implemented and tracked in Scrut.io, and the internal audit is complete. We are awaiting the independent third-party certification audit.
GDPR controls are implemented and monitored in Scrut.io, and our internal readiness audit is complete. They are evidenced within the SOC 2 and ISO 27001 third-party audits now underway. DPA and EU data residency are available on the Enterprise tier today.
Privacy notices, retention schedules, and opt-out (Do Not Sell or Share) controls are implemented and monitored in Scrut.io, and our internal readiness audit is complete — evidenced within the third-party audits now underway.
Citation hierarchy and audit trails already satisfy the transparency mandate; the controls are tracked in Scrut.io with our internal audit complete. Customer-facing disclosures ship July 2026.
Sub-processors
Updated monthly. Every sub-processor has a signed DPA with PYRAMYD. We'll notify you in writing 30 days before adding a new one.
| Sub-processor | Region | Purpose |
|---|---|---|
| Microsoft Azure | US (Central US) | Cloud hosting — compute, PostgreSQL, storage, Key Vault |
| Vercel | Global (Edge) | Application + marketing hosting and edge CDN |
| Okta (Auth0) | US | Authentication and identity |
| OpenAI / Azure OpenAI | US | LLM inference for AI features |
| Anthropic | US | LLM inference (Claude family) for AI features |
| Cloudflare | US | DNS, CDN, and web application firewall |
| Stripe | US / global | Payments and subscription billing |
| Sentry | US | Application error tracking (PII-scrubbed) |
| GitHub | US | Source-code management and CI |
| Google Workspace | US | Internal email and document collaboration |
| HubSpot | US | Marketing, CRM, and email |
| Intercom | US | In-product messaging and support |
| Apollo.io | US | Sales intelligence |
Artifacts on request
Available under NDA via direct request. Most responses turn around within one business day.
Pre-filled answers to the standard 200-question security questionnaire (CAIQ-Lite + SIG-Lite alignment).
Most recent third-party penetration test report summary, redacted for distribution under NDA.
Data Processing Agreement and complete sub-processor list (refreshed monthly).
Incident classification, communication timeline, customer notification SLAs, and historical incident log.
Incident response
Detailed incident response plan available under NDA at security@pyramyd.ai.
Pre-filled CAIQ-Lite + SIG-Lite. DPA in two days. We're responsive because we've been on the other side of this conversation.
