Security & Compliance

Your Data Is Safe With Us

Torii’s applications and services are designed with security in mind. Clear procedures and automated controls ensure your data remains protected while you stay in control.

Questions about our security measures?

Email our dedicated security team at [email protected].

Your Data Is Safe With Us - Torii
Infrastructure Security

Cloud Data Storage

Torii leverages Amazon Web Services for hosting and compute power. Amazon maintains and demonstrates SSAE-16 SOC 1, 2 and 3, ISO 27001 and FedRAMP/FISMA reports and certifications. Web servers and databases run on servers in secure data centers.

Cloud Data Storage - Torii
Backups - Torii
Infrastructure Security


To maintain a robust disaster recovery strategy, Torii leverages Amazon Aurora automated daily backups which allows us secure backups as well as quick recovery. We test our backup recovery regularly.
Infrastructure Security


All data stored in the Service is encrypted both in transit and at rest. Database instances, including read replicas and backups, are encrypted using the industry standard AES-256 encryption algorithm. Encryption is enforced via TLS to all data in transit.

Encryption - Torii
Authentication - Torii
Application Security


Torii authenticates all users with a unique ID and password. All Torii user passwords are encrypted and salted using Bcrypt. Access to Torii restricted API resources are always authenticated.

Application Security


Torii supports SAML 2.0 authentication, allowing customers to implement Single Sign-On (SSO) with their own access policies, including whitelisting and multi-factor authentication (MFA). Customers may also integrate user authentication with their own policy store (e.g., Active Directory).

SAML & MFA - Torii
Confidentiality - Torii
Information Security Controls


All Torii employees and contractors sign confidentiality agreements upon commencing work for Torii.

Information Security Controls

Training Programs

Torii employees and contractors are trained upon hire and no less than annually thereafter regarding confidentiality, data security, and data handling practices.

Training Programs - Torii
Role-Based Access Controls - Torii
Information Security Controls

Role-Based Access Controls

Administrative access to our production environment is limited to a restricted number of individuals. Access to additional individuals is given only in extreme circumstances, for a specific purpose, and is limited in duration. Such access to these additional individuals is given only after the explicit approval of the security team. User access is evaluated on a quarterly basis and revoked upon termination.

Information Security Controls

Vendor Management Program

Torii reviews the security and privacy practices of potential vendors to ensure their standards meet or exceed our own.

Vendor Management Program - Torii
Business Continuity and Disaster Recovery - Torii
Information Security Controls

Business Continuity and Disaster Recovery

Torii has implemented business continuity and disaster recovery policies designed to secure your data even in the event of a disaster. We review our policies no less than annually.

Information Security Controls

Logging and Monitoring

Torii has implemented monitoring across all components in the architecture. Alerts are generated and sent to relevant stakeholders using internal communications platforms based on predefined rules. The notifications are reviewed and processed based on their level of urgency / priority.

Logging and Monitoring - Torii
Vulnerability Scanning and Penetration Testing - Torii
Information Security Controls

Vulnerability Scanning and Penetration Testing

Torii performs at least one penetration test per year, which is conducted by accredited and completely independent information security companies. Vulnerabilities, if found, are addressed as part of our Risk Management Policy.

Information Security Controls

Endpoint Scanning

All employees and contractor laptops are equipped with software to scan for malicious threats.

Endpoint Scanning - Torii
Annual Third-Party Audits - Torii
Information Security Controls

Annual Third-Party Audits

Torii undergoes annual independent SOC 2, Type II audits for security, availability, and confidentiality.

SOC 2 Type II - Torii

SOC 2 Type II

Torii is SOC 2 Type II certified, confirming that the product and services Torii provides are mature, robust, and secure, and that we are actively creating an organization that supports these goals.
It also means that our software development processes and practices meet required levels of oversight and monitoring, so that we can proactively monitor, identify and address any unusual activity, remediate it with deep contextual insight, and take corrective action, if and when it is needed.
EU GDPR - Torii


With customers in nearly every country around the world, we adhere to the General Data Protection Regulation (GDPR) expanding the privacy rights granted to European individuals.
We proactively look at and constantly improve processes related to personal data privacy protection in compliance with legal and contractual obligations for GDPR compliance.

If you have a security question please contact our Security Team

Your Privacy Matters to Us

Torii knows data privacy is important. That’s why we design our products and services with your privacy in mind, and why we are committed to providing you with the information you need about how we handle personal data. Questions about our privacy measures that we didn’t address above? Check out the links below, or email us at [email protected].


New Torii Pricing 🚀

Find the right plan at the right price.
Get a 14 day free trial, no credit card needed.