# Vistaly Privacy & Security Fact Sheet

**Last Updated: April 2026**

## Key Documents & Resources

### Public Documentation

- 🔒 [Security Policy](/content/security/index.html) 
- 📜 [Privacy Policy](/content/privacy-policy/index.html) 
- 📋 [Terms of Service](/content/terms-of-service/index.html) 
- 🌐 [GDPR Compliance](/content/gdpr-compliance/index.html) 
- 🏢 [Sub-Processors](/content/sub-processors/index.html) 
- 🍪 [Cookie Policy](/content/cookie-policy/index.html) 
- 📊 [System Status](https://status.vistaly.com/)

### Available Upon Request

- **SOC 2 Type 2 Report** 
- **Data Privacy Framework Verification**

### Business Plan Added Support

Business & Enterprise customers receive additional security support including:

- **Data Processing Agreement (DPA)**
- **Security Architecture Walkthroughs** 
- **Custom Security Assessments** 
- **Standard Contractual Clauses (SCCs)** 
- **Dedicated Security Reviews** 
- **Custom Legal Agreements**

### Quick Reference

✓SOC 2 Type 2 Certified  
✓GDPR Compliant  
✓EU-U.S. Data Privacy Framework Certified  
✓Data Residency: US or EU (customer-selected)

Infrastructure:
AWS US & EU regions (SOC 1/2/3, ISO 27001/27017/27018/27701)

Security Contact: [security@vistaly.com](mailto:security@vistaly.com)

Data Protection Officer: [dpo@vistaly.com](mailto:dpo@vistaly.com)

## 1. Data Privacy & Rights

### 1.1 Your Data Ownership

- **You own your data**

### 1.2 Who Can Access Your Data

#### Our Employees

- Access granted on least-privilege basis only

#### Third-Party Sub-processors

We maintain transparency about our sub-processors.

### 1.3 Your Control & Rights

- Export your data anytime
- Delete your account or organization data
- Full GDPR rights: access, correction, deletion, portability, restriction

### 1.4 Geographic Data Processing & Data Residency

- **Data Residency:** Customers choose their data region during account creation.  
- **Primary Infrastructure:** AWS us-east-1 (US) or AWS eu-west-1 (EU).  
- **International Transfers:** Covered by DPF certifications, SCCs, and DPAs

## 2. Data Security

### 2.1 Encryption

- **At Rest:** AES-256 encryption for all stored data
- **In Transit:** TLS 1.2+ for all data transmission
- **Backup:** Fully encrypted

### 2.2 Access Controls

- Single Sign-On (SSO) via Google OAuth
- Multi-factor authentication available
- Role-based access control (RBAC)

### 2.3 Infrastructure Security

- AWS certified infrastructure
- DDoS protection and Web Application Firewall

### 2.4 Security Monitoring

- Real-time monitoring and alerting

### 2.5 Incident Response

- **Data Breaches:** GDPR-compliant 72-hour notification

### 2.6 Backup & Recovery

- Daily automated backups

## 3. Data Isolation

### 3.1 Architecture

- Workspace-level separation with distinct access controls

### 3.2 Customer Data Segregation

Vistaly implements comprehensive data isolation to ensure complete separation between customer organizations.

## 4. Compliance & Assurance

### 4.1 Active Certifications

| Certification | Scope | Verification |
| --- | --- | --- |
| SOC 2 Type 2 | Security, Availability, Confidentiality | Available on request |
| GDPR | Full compliance | [Policy](/content/gdpr-compliance/index.html) |
| EU-U.S. DPF | Data transfers | [Certificate](https://www.dataprivacyframework.gov/s/participant-search) |
| UK Extension DPF | UK transfers | [Certificate](https://www.dataprivacyframework.gov/s/participant-search) |
| Swiss-U.S. DPF | Swiss transfers | [Certificate](https://www.dataprivacyframework.gov/s/participant-search) |

### 4.2 Third-Party Validation

- Independent SOC 2 Type 2 audit

### 4.3 Contractual Commitments

- **All Customers:** Data Privacy Framework certification

## 5. Operational Security

### 5.1 Development Security

- Mandatory code review process

### 5.2 Employee Security

- Security training and policy acknowledgment required

### 5.3 Vendor Management

- Risk assessments before data sharing

### 5.4 Business Continuity

- 99.9% uptime target

### 5.5 Security Governance

- Designated Data Protection Officer

## Contact Us

### For Immediate Needs

- **Security Concerns:** [security@vistaly.com](mailto:security@vistaly.com)
- **Data Protection:** [dpo@vistaly.com](mailto:dpo@vistaly.com)
- **General Support:** [support@vistaly.com](mailto:support@vistaly.com)

This document provides a high-level overview of Vistaly's security and privacy practices for customer evaluation. For detailed technical specifications, please refer to the linked policies or contact our security team.