SOC 2 Type IIGDPRHIPAA-Ready99.99% SLA

Enterprise-Grade by Default

Deployed in isolated environments, secured by native SAML/OIDC identity, and backed by a 99.99% SLA. Aforo meets the strictest procurement and compliance requirements.

TRUST CENTER

Four Pillars of Enterprise Readiness

Security, identity, infrastructure, and support — each pillar engineered to clear your most rigorous procurement reviews.

SECURITY & COMPLIANCE

Audited & Compliant

SOC 2 Type II Certified
GDPR & CCPA Data Processor Compliant
HIPAA-Ready (BAA Available)
256-bit AES Encryption at rest and in transit
IDENTITY & ACCESS MANAGEMENT

Zero-Trust Architecture

Native SAML 2.0 & OIDC integration
Granular Role-Based Access Control (RBAC)
Enforced MFA at the tenant level
Custom Session TTL policies
DEPLOYMENT & INFRASTRUCTURE

Isolated & Resilient

Logical and physical tenant database isolation
AWS / GCP VPC Peering Options
99.99% Uptime SLA
Multi-Region redundancy
SUPPORT & OPERATIONS

White-Glove Support

Dedicated Technical Account Manager (TAM)
Shared Slack Connect Channel for real-time triage
Custom MSAs & Invoicing
24/7 Severity 1 incident paging
99.99%

Uptime SLA

Contractual guarantee

AES-256

Encryption standard

At rest and in transit

<4 hrs

Sev-1 response time

24/7/365 paging

Zero

Cross-tenant data risk

Full logical isolation

SECURITY ARCHITECTURE

Defense in Depth, by Design

Not bolted on after launch. Every security control is part of the core architecture from day one.

Data Encryption

01AES-256-GCM encryption for all credentials and secrets at rest
02TLS 1.3 enforced on all service-to-service communication
03Per-tenant encryption key derivation — no shared master key exposure

Identity & Authentication

01Enterprise SSO via SAML 2.0, OIDC, and OAuth 2.0 with PKCE
02Tenant-level MFA enforcement with configurable session TTL
03JWT-based inter-service auth with short-lived, non-replayable tokens

Tenant Isolation

01Separate database schemas per tenant — no shared tables, no row-level filtering
02Isolated Redis cache keyspaces, Kafka topic prefixes, and event streams
03TenantContext propagation enforced on every service call, scheduler, and async worker

Audit & Observability

01Immutable, append-only audit trail on every configuration and financial change
02Distributed tracing (OpenTelemetry) across all 11 microservices
03Exportable audit logs for SOC 2 evidence collection and vendor security reviews
PROCUREMENT READY

Pass your vendor security review on the first attempt

SOC 2 Type II audit report available under NDA
GDPR Data Processing Agreement (DPA) executed on request
HIPAA Business Associate Agreement (BAA) available
Annual penetration test results shareable under NDA
Custom MSA and security addendum supported
Dedicated CSM and TAM assigned pre-signature
SLA-backed response times documented in contract
Data residency options (US, EU) with isolation guarantees

Ready to clear your security review?

Our enterprise team will walk your InfoSec, Engineering, and Procurement stakeholders through the full security architecture, compliance posture, and deployment options.