Security / trust page — found from the homepage — Tomorro

Cited by

Facts read from this source

• ISO 27001 Report an error

  “Tomorro is ISO 27001 certified.”

• ISO 27001 version Report an error

  “ISO 27001:2022 certified”

• GDPR Report an error

  “Our privacy and data processing policy complies with the General Data Protection Regulation.”

• Dora Report an error

  “Digital Operational Resilience Act (DORA)”

• EU AI act Report an error

  “EU AI Act readiness”

• Vanta monitoring Report an error

  “Our compliance and security posture are continuously monitored through Vanta to ensure full transparency.”

• Pci stripe Report an error

  “Stripe, our payment provider, has been audited by an independent PCI Qualified Security Assessor (QSA) and is certified as a Level 1 PCI Service Provider.”

• Pentest annual Report an error

  “Independent penetration tests carried out annually by third-party experts.”

• Provider Report an error

  “Hosting is provided by Amazon Web Services”

• Region Report an error

  “Your production data (infrastructure and data) is hosted exclusively in France, on AWS in the eu-west-3 region (Paris).”

• Backup region Report an error

  “Cross-region backups are stored on AWS eu-central-1 (Frankfurt, Germany) to ensure resilience against regional incidents. All data remains within the European Union.”

• Availability zones Report an error

  “Your production data is replicated in real time across 3 distinct AWS Availability Zones (AZs)”

• Backup retention days Report an error

  “automatic daily snapshots retained for 365 days”

• Pitr rpo Report an error

  “continuous backups enabling Point-in-Time Recovery (PITR) with a maximum data loss of 5 minutes (RPO 5 min)”

• Failover Report an error

  “with automatic failover within seconds in the event of an incident”

• Encryption Report an error

  “All data is encrypted, including backups, using different encryption keys during transmission as well as during storage.”

• Encryption protocol Report an error

  “Data transmission is only carried out using the TLS/SSL protocol.”

• Physical security Report an error

  “Tomorro's premises are monitored 24 hours a day by an alarm and video surveillance system.”

• Sdlc Report an error

  “Secure software development lifecycle (SDLC) with code reviews, automated testing, and vulnerability scanning.”

• Environment isolation Report an error

  “Isolated development, staging, and production environments.”

• Monitoring tools Report an error

  “Continuous monitoring via Datadog and incident management through Sentry.”

• Backups daily Report an error

  “And for added security, we make daily backups.”

• Backup key rotation Report an error

  “Data and backup encryption keys are changed regularly.”

• Security contact Report an error

  “If you have any questions or would like to report a vulnerability, please reach out to our security team.”

• Customer count Report an error

  “2000+ companies manage their contracts with Tomorro”

• Public API Report an error

  “Public API”

Scores citing this record

• The Data Protection Officer European sovereignty
• The General Counsel European sovereignty
• The IT Integrator European sovereignty
• The Procurement Analyst European sovereignty
• The Sales Ops Owner European sovereignty
• The Skeptic European sovereignty