Chainalysis

A current SOC 2 report or ISO/IEC 27001 certificate is the usual evidence that a supplier operates appropriate security measures.

• SOC 2Vendor states SOC 2 Type II on its trust centreas of 21 Sep 2026
• ISO/IEC 27001Vendor states ISO 27001:2022 on its trust centreas of 21 Sep 2026

A penetration test report, a completed standard questionnaire (SIG, CAIQ, HECVAT) or security documentation shows how the supplier tests and runs its controls.

• Penetration testing"How often do you perform penetration tests?" We perform independent third-party penetration tests at least annually and employ an internal Red Team for continuous security assessments.as of 21 Sep 2026

The DPA is where processing instructions, confidentiality, security, sub-processing and audit rights are written down.

A current list of subprocessors, with purpose and location, is how a customer knows who else touches its data.

An incident response plan or a published notification commitment shows how and when the supplier tells customers about incidents.

Transfers outside the EU or UK need a basis such as an adequacy decision (including the EU-US Data Privacy Framework) or standard contractual clauses.

• EU-US Data Privacy FrameworkActive: SW-US Certification, EU-US Certification, UK Extension Certificationas of 17 Sep 2026

The regions or countries where the service runs and data is stored, from the vendor or its subprocessor list.