What security certifications do you hold (SOC 2, ISO 27001)?

Straight answer first. Bosskit does not hold SOC 2, ISO 27001 or ISMS certification today. No audit is in progress either.

A certification means a third-party auditor spends months testing controls and then issues a report, and we have not started that. We are not going to phrase this as "coming soon" or "aligned with" to make it sound like we have one.

Here is what we do actually run.

• Isolation between companies: the database itself blocks one company from reading another's rows. If our code ever forgets a condition, the database still catches it.
• Credential protection: passwords are stored in a form that cannot be reversed, and AI keys and integration keys are encrypted. Neither is ever shown back in full.
• Attacker's-eye review: we ran a pass over authentication, permissions, uploads and outbound requests from an external attacker's perspective, fixed what it found, and re-checked.
• Records: approvals, setting changes, publishing and deploys land in the audit log. When an operator opens your company's information to answer a support ticket, that access is logged too.
• Incident response: we run monitoring that detects and alerts on service problems.

What we do not have, written down. No third-party certification, no recurring external penetration test report, no contractual uptime guarantee (SLA), and no backup schedule of our own yet. Backups currently rely on our infrastructure provider's managed database; our own scheduled backups are still being set up.

If your security team needs to run due diligence or send a questionnaire, tell us through Help Center support. We will put the above into a document for you and write "none" next to anything we cannot answer.