Compliance FAQ
This page addresses frequently asked questions and common compliance topics for Polyaxon. Please refer to security FAQs for details on security topics.
If you don't find a solution to your issue here, reach out to [email protected]
Compliance & Certifications
Which audits and attestations are in place?
Polyaxon is in the process of SOC 2 Type II and ISO 27001 certification. We maintain internal policies aligned with these frameworks.
Which policies does Polyaxon have in place?
Polyaxon maintains a list of policies to meet or exceed requirements from the SOC 2 Type II and ISO 27001 certifications. See Policy overview for a full list of policies.
What policies do you have in place for data protection and privacy?
We have policies in place data protection, classification, and retention. See privacy FAQ for more details.
How often are third‑party pen tests performed, and are results shareable?
Independent penetration tests occur annually, plus continuous vulnerability scans. See penetration testing for more details and past results.
How does Polyaxon manage risk?
Polyaxon manages risk through a formal process of identifying threats and vulnerabilities to our assets. We then assess the potential impact and likelihood of each risk to calculate a score, which determines its priority. All high and critical risks must be treated, and our entire risk management framework is reviewed at least annually to adapt to new threats.
How does Polyaxon manage its vendors?
Polyaxon maintains an inventory of all vendors and classify them by risk level based on the data they access. For all third parties, especially high-risk vendors, we enforce strict contractual requirements covering security and privacy. We verify their compliance by reviewing security documentation, such as SOC 2 or ISO 27001 reports, to ensure their practices align with our standards.
Sub-processors & Third-Party Risk
Which sub-processors have access to customer data?
The live list is published here.
Governance, People & Culture
How does the Acceptable Use Policy look like?
Our policy ensures that all personnel undergo background checks (ID and reference calls), agree to our terms, and receive security awareness training to handle data responsibly. It mandates strict security measures such as whole-disk encryption on laptops, protection against malware, and rules for the proper handling of sensitive information. The policy governs the entire employee lifecycle, from secure onboarding to offboarding, to protect company and customer data.
How does the code of conduct look like?
Our Code of Conduct establishes the highest standards of ethical business conduct, requiring all employees and contractors to act with integrity and comply with the law. It outlines our commitment to a safe, supportive, and inclusive work environment, with strict prohibitions against harassment, discrimination, and conflicts of interest. The policy provides clear channels for reporting concerns without fear of retaliation and details our procedures for protecting confidential information and company assets.