Twic

Security and trust center evidence

Forma’s flexible benefits software helps companies offer competitive benefits packages while reducing

joinforma.com Benefits and insuranceLast verified 2 Nov 2026

Request the report Are you Twic?

SOC 2Vendor-stated

PCI DSSVerified

ISO 27001Vendor-stated

DPFVerified

Twic has 2 registry-verified rows and 2 vendor-stated rows in the CertReports index, last verified 2 Nov 2026. The strongest row is SOC 2: Vendor states SOC 2 Type II on its trust centre. This page is independent of the vendor’s own trust centre: dates, sources and caveats come from CertReports captures.

Reviewer brief

Twic states on its trust centre that it holds a SOC 2 Type II report, as of 30 Sep 2026. Twic also states on its trust centre that it holds ISO/IEC 27001:2022, as of 30 Sep 2026. Twic is listed in the Visa Global Registry as PCI DSS validated through 31 Dec 2026, with ControlCase, LLC as auditor, as of 12 Oct 2026. Twic's EU-US Data Privacy Framework status is expired, having been listed as inactive since 31 Dec 2019, as of 12 Oct 2026. No public evidence found for a HIPAA BAA as of 12 Oct 2026.

PCI DSS: listed in the Visa Global Registry, validated through 31 Dec 2026 (auditor ControlCase, LLC), as of 12 Oct 2026.
SOC 2 Type II: vendor states on its trust centre, as of 30 Sep 2026.
ISO/IEC 27001:2022: vendor states on its trust centre, as of 30 Sep 2026.

Facts only, each dated; nothing here is inferred, scored or advised. Brief generated 13 Oct 2026; it is regenerated whenever a row changes.

Among benefits and insurance vendors

2verified rows

Category median 1, across 24 indexed benefits and insurance vendors. Twic has more verified rows than 92 percent of them.

benefits administrationflexible benefitsfsahsa

Compare with similar vendors

Pick your own comparison

Compliance grid

No public evidence yet for HIPAA, GDPR, FedRAMP, CSA STAR, Cyber Essentials, ISO 27701, ISO 42001. This does not mean the vendor lacks them; it means nothing public was found at the last check.

Legal artefacts

Subprocessor list

Public · 9 subprocessors listed on the trust centre · as of 30 Sep 2026

Open

Public · as of 30 Sep 2026

Open

Public trust centre documents

Public · PCI Compliance Certificate · as of 18 Sep 2026

Open

Subprocessors (9)

Amazon Web ServicesUnited States
BR
BraintreeUnited States
BugsnagUnited States
Google Cloud PlatformUnited States
Microsoft AzureUnited States
MongoDB AtlasUnited States
Stripehttp · United States
UnitUnited States
ZendeskUnited States

Security profile

Pen test cadence: annual

Displayed as a security profile from public statements, not as attestations, as of 30 Sep 2026.

Change history

2 Nov 2026EU-US Data Privacy Framework state changedState moved from Expired to Verified.
12 Oct 2026PCI DSS state changedState moved from Vendor-stated to Verified.
12 Oct 2026PCI DSS auditor changedAuditor changed from unknown to ControlCase, LLC.
29 Sep 2026Subprocessor removed: AmplitudeAmplitude left the subprocessor list.
18 Sep 2026Subprocessor added: AmplitudeAmplitude appeared on the subprocessor list.
18 Sep 2026Subprocessor added: BraintreeBraintree appeared on the subprocessor list.
18 Sep 2026Subprocessor added: BugsnagBugsnag appeared on the subprocessor list.
18 Sep 2026Subprocessor added: Google Cloud PlatformGoogle Cloud Platform appeared on the subprocessor list.
18 Sep 2026ISO/IEC 27001 evidence addedA ISO/IEC 27001 row entered the index with state Vendor-stated.
18 Sep 2026Subprocessor added: MongoDB AtlasMongoDB Atlas appeared on the subprocessor list.

Similar vendors with evidence

Related by product tags and the Benefits and insurance category, ranked by shared tags, description similarity and overlapping evidence. Never by popularity.