Security & Compliance
Enterprise-grade security.
Privacy by design.
Torii's applications and services are built with security at their core. Clear procedures and automated controls keep your data protected—while you stay in control.
SOC 2 Type II
Independently audited every year for security, availability & confidentiality.
Encrypted end-to-end
AES-256 at rest and TLS in transit—your data is protected everywhere.
Tested by experts
Annual penetration tests by accredited, fully independent firms.
GDPR Compliant
Privacy rights honored for customers in nearly every country worldwide.
Certifications
Independently verified. Continuously audited.
We don't just say our security is strong—we prove it with recognized certifications and ongoing third-party review.
SOC 2 Type II
Torii is SOC 2 Type II certified, confirming that our product and services are mature, robust, and secure. Our software development processes and practices meet required levels of oversight and monitoring—so we can proactively identify, address, and remediate any unusual activity with deep contextual insight.
GDPR
With customers in nearly every country around the world, we adhere to the General Data Protection Regulation (GDPR), expanding the privacy rights granted to European individuals. We proactively review and continuously improve our personal-data privacy processes to stay compliant with legal and contractual obligations.
How we protect your data
Security built into every layer
From the infrastructure your data lives on to the people who operate it, defense-in-depth controls protect you at every step.
Cloud Data Storage
Torii leverages Amazon Web Services for hosting and compute power. AWS maintains SSAE-16 SOC 1, 2 and 3, ISO 27001, and FedRAMP/FISMA certifications. Web servers and databases run in secure data centers.
Backups
To maintain a robust disaster recovery strategy, Torii leverages Amazon Aurora automated daily backups—enabling secure backups and quick recovery. We test our backup recovery regularly.
Encryption
All data in the Service is encrypted in transit and at rest. Database instances, read replicas, and backups use industry-standard AES-256 encryption, and encryption is enforced via TLS for all data in transit.
Authentication
Torii authenticates every user with a unique ID and password. All passwords are encrypted and salted using Bcrypt, and access to restricted API resources is always authenticated.
SAML & MFA
Torii supports SAML 2.0, letting customers implement Single Sign-On (SSO) with their own access policies—including whitelisting and multi-factor authentication (MFA)—and integrate with their own policy store, such as Active Directory.
Confidentiality
All Torii employees and contractors sign confidentiality agreements upon commencing work for Torii.
Training Programs
Employees and contractors are trained upon hire, and no less than annually thereafter, on confidentiality, data security, and data-handling practices.
Role-Based Access Controls
Administrative access to production is limited to a restricted number of individuals. Additional access is granted only in extreme circumstances, for a specific purpose and limited duration, and only after explicit approval by the security team. Access is reviewed quarterly and revoked upon termination.
Vendor Management Program
Torii reviews the security and privacy practices of potential vendors to ensure their standards meet or exceed our own.
Business Continuity & Disaster Recovery
Torii has implemented business continuity and disaster recovery policies designed to secure your data even in the event of a disaster. We review these policies no less than annually.
Logging & Monitoring
Monitoring is implemented across all components of the architecture. Alerts are generated on predefined rules and routed to the right stakeholders, then reviewed and processed based on urgency and priority.
Vulnerability Scanning & Pen Testing
Torii performs at least one penetration test per year, conducted by accredited, completely independent information-security firms. Any vulnerabilities found are addressed under our Risk Management Policy.
Endpoint Scanning
All employee and contractor laptops are equipped with software that scans for malicious threats.
Annual Third-Party Audits
Torii undergoes annual, independent SOC 2 Type II audits for security, availability, and confidentiality.
Your privacy matters to us
Torii knows data privacy is important. That's why we design our products and services with your privacy in mind, and why we're committed to giving you the information you need about how we handle personal data. Questions we didn't cover here? Email us at privacy@toriihq.com.
Questions about our security?
Talk to the team that safeguards your data
Our dedicated security team is here to answer your questions, share documentation, and walk you through how Torii keeps your data safe.
Email security@toriihq.com