ObservePoint Security Overview
ObservePoint protects its platform and your data through a formal information security program. The program is independently audited under SOC 2 Type II, every year.
For audit reports, security policies, penetration test summaries, and a live view of our security controls, visit the ObservePoint Trust Center.
What data ObservePoint handles
ObservePoint scans only the websites, apps, and pages that you configure. It does not connect to your internal systems or databases, and it does not collect any data about your website visitors or customers. The data ObservePoint holds falls into three groups:
Scan results. These are the tags, cookies, network requests, page content, and screenshots captured by ObservePoint browsers from the pages you choose to scan.
Account data. This is business contact information, such as names and email addresses, for your ObservePoint users.
Scan credentials. These are the optional test-account logins that let scans reach authenticated pages. They are encrypted at rest, and access to them is restricted by role. See How ObservePoint Protects Your Scan Credentials.
ObservePoint can also optionally scan pre-production sites through a VPN tunnel or an IP allowlist.
Security at a glance
Area | Our practice |
Independent assurance | SOC 2 Type II, audited annually |
Penetration testing | Independent third-party testing at least annually |
Hosting and data residency | Amazon Web Services (AWS) and Snowflake, both in us-west-2 (Oregon) |
Encryption | TLS 1.2 or higher in transit; customer data and backups encrypted at rest |
Access control | SSO, multi-factor authentication (MFA), least privilege, regular access reviews |
Vulnerability management | Continuous automated scanning, with fixes prioritized by severity |
Endpoint security | Anti-malware/EDR, full-disk encryption and mobile device management (MDM) on all staff devices |
Resilience | Automated, encrypted backups and a regularly tested disaster recovery plan |
Incident response | Documented response plan; impacted customers are notified promptly of any confirmed breach affecting their data |
Privacy | Supports GDPR, UK GDPR, CCPA/CPRA and other privacy laws; Data Processing Agreement (DPA) available |
People | Background checks, confidentiality agreements and annual security awareness training |
Vendor risk | Security review before onboarding, plus ongoing monitoring of critical vendors |
Learn more
The Trust Center lists our full set of security controls, and you can request our SOC 2 report, penetration test summary, and policies there. For security questionnaires or other questions, contact your account team or [email protected].