Ready for your
vendor review.
Convoy holds a SOC 2 report and an ISO/IEC 27001 certification, and we're HIPAA compliant. The promises that matter to you are written into the contract.
Where we stand
Questions for your review? Book a briefing →
Compliance
SOC 2
An independent auditor tested how our controls actually worked over a full audit period, not on a single day.
Audited
ISO/IEC 27001
Our information security management system is certified to ISO/IEC 27001. That covers how we find risk, choose controls and keep them working.
Certified
HIPAA
Convoy is HIPAA compliant, and we don't store PHI.
Compliant
Your data
Some data we never hold.
The less we keep, the less there is to lose. A few things never land in Convoy at all.
0
PHI stored
Convoy doesn't store protected health information.
0
Cardholder data stored
Convoy doesn't store PCI cardholder data.
1:1
Tenant isolation
Every customer's data sits in its own tenant, and every request is scoped to it.
In the contract
Commitments you can hold us to.
A security vendor with weak controls is just another way in. These are written into our agreements.
99.95%
Uptime
A platform commitment in every agreement.
RBAC
Permissions on every call
Role-based access, checked on each request in the console, the API and the MCP server.
100%
Audited
Every response action and rule change is recorded, whether a person, a playbook or one of your own AI tools made it.
2 days
To acknowledge a report
Found a weakness in something we run? Our disclosure program answers within 2 business days.