Antigen

A current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.

• SOC 2 report"SOC 2 Type II — Letter of Engagement" on the trust centreas of 21 Sep 2026

A penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.

• Penetration testing"How does Antigen isolate pen testing environments?" Every engagement executes inside a dedicated Firecracker microVM with its own Linux kernel, enforced by hardware-level CPU virtualization (Intel VT-x). This is the same isolation technology that underpins AWS Lambda....as of 21 Sep 2026

The DPA is where processing instructions, confidentiality, security, sub-processing and audit rights are written down.

A current list of subprocessors, with purpose and location, is how a customer knows who else touches its data.

• Subprocessor list5 subprocessors listed on the trust centreas of 21 Sep 2026
• Subprocessor list5 subprocessors listedas of 21 Sep 2026

An incident response plan or a published notification commitment shows how and when the supplier tells customers about incidents.

Transfers outside the EU or UK need a basis such as an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.

The regions or countries where the service runs and data is stored, from the vendor or its subprocessor list.

• Subprocessor locations4 of 5 subprocessors list a locationas of 21 Sep 2026