Security Protecting your firm’s data
Our security controls protect the confidentiality, integrity and availability of your firm’s data across InvestorCOM products.
- SOC 2 Type 2 report
- Canadian and US hosting
- WORM records
- Annual penetration testing
InvestorCOM’s security control framework
Controls for data protection, access management, recordkeeping and monitoring.
SOC 2 Type 2
Independent auditors test our controls every year. Clients can request the report under NDA.
Data protection
Encrypted in transit and at rest, with secure key management and monitored access.
Canadian and US hosting
Microsoft Azure, with separate Canadian and US environments.
Access controls
Role-based permissions limit each user to the data and functions their job needs.
WORM records
Write Once, Read Many storage that supports SEC Rule 17a-4.
Monitoring and testing
Continuous monitoring and alerting, third-party penetration testing every year, and regular internal reviews.
Your firm decides whether to enable AI features. The controls below apply to every feature.
AI features are off by default. If you don’t turn them on, no data from your firm is sent to an AI model.
AI processing stays in your firm’s country, Canada or the US.
Your data is never used to train AI models.
A person at your firm makes the decision. We retain a record.
Ongoing security reviews
We review our controls as the platform, security threats and your firm’s requirements change.
Ongoing review
Controls maintained and tested year-round.
Regulatory alignment
Transparency
Documentation to support your due diligence.