# Security at the core

Air takes data protection seriously. Enterprise-grade infrastructure, rigorous development practices, and security are built into every layer so you can focus on creating.

## Compliance

SOC 2  
GDPR  
AWS Foundational Technical Review

## Resources

### Policy and Compliance Documents

- [Air SOC 2 Type II Report](https://trust.air.inc/?requestAccessOpen=true&requestedResources=6a315f9fe373ffd83e911c7b)  
- [Air SOC 3 Report](https://trust.air.inc/?requestAccessOpen=true&requestedResources=6a316408875408484ee8a21a)  
- [Acceptable Use Policy](https://trust.air.inc/?requestAccessOpen=true&requestedResources=69b00605e6a1d038612757c3)  
- [Authorization and Signing Authority Policy](https://trust.air.inc/?requestAccessOpen=true&requestedResources=69b006058680cbea7649f22f)  
- [View 25 more](https://trust.air.inc/resources#6a396ffd25440bb2b34daf5f)

### Penetration Testing Reports

- [Penetration Test Executive Summary 2026](https://trust.air.inc/?requestAccessOpen=true&requestedResources=6a396d8ef4f9d2c9143ac98f)  
- [Penetration Test Full Report 2026](https://trust.air.inc/?requestAccessOpen=true&requestedResources=6a396ddff4f9d2c9143add30)

### Cyber Insurance

- [Certificate of cyber insurance](https://trust.air.inc/?requestAccessOpen=true&requestedResources=69e630359b7a40c6b4785b22)

## Controls

Updated 15 minutes ago

[View all](https://trust.air.inc/controls)

[**Infrastructure security**](https://trust.air.inc/controls#infrastructure-security)

- Encryption key access restricted  
- Unique account authentication enforced  
- Production application access restricted

[View 9 more Infrastructure security controls](https://trust.air.inc/controls#infrastructure-security)

[**Organizational security**](https://trust.air.inc/controls#organizational-security)

- Code of Conduct acknowledged by employees and enforced  
- Confidentiality Agreement acknowledged by employees  
- Performance evaluations conducted

[View 5 more Organizational security controls](https://trust.air.inc/controls#organizational-security)

[**Product security**](https://trust.air.inc/controls#product-security)

- Control self-assessments conducted  
- Vulnerability and system monitoring procedures established  
- Penetration testing performed

[**Internal security procedures**](https://trust.air.inc/controls#internal-security-procedures)

- Continuity and Disaster Recovery plans established  
- Continuity and Disaster Recovery plans tested  
- Configuration management system established

[View 26 more Internal security procedures controls](https://trust.air.inc/controls#internal-security-procedures)

[**Data and privacy**](https://trust.air.inc/controls#data-and-privacy)

- Data retention procedures established  
- Data classification policy established

## Subprocessors

- Amazon Web Services • Cloud provider  
- GitHub • Version control  
- Vanta • Security  
- Continuous security and compliance monitoring  
- Datadog • Observability  
- United States

## Ask Air a question

Example questions  
- Can you list all the subprocessors for Air?  
- How does Air handle access controls and authentication?  
- What compliance frameworks and certifications does Air follow?