Security and Compliance

Trust Portal

At Behavox, we are committed to transparency and security. Our Trust Center provides self-service access to essential security, data privacy, and compliance documents, ensuring our customers and third-party auditors can easily find the information they need.
Through the Behavox Trust Center, you can:
  • Request and download security and compliance reports
  • Access data privacy policies and commitments
  • Review our security measures and controls
To access these documents, visit our Behavox Trust Center and submit a request. Our team will review your request and provide access based on your eligibility.

Customers and prospects can request the latest version of our SOC 2 report through the Behavox Trust Center. Access will be granted based on eligibility and approval.

SOC 2
Type II Compliant

SOC 2 Type II-compliant conduct and compliance solutions

Behavox strictly adheres to SOC 2 Type II standards to deliver the industry’s most secure and trusted compliance and conduct risk mitigation.

What is  SOC 2 Type II compliance?

The American Institute of Certified Public Accountants (AICPA) System and Organization Controls (SOC) reports give assurance over control environments as they relate to the retrieval, storage, processing, and transfer of data.

Completion of SOC 2 Type II reports attests to our commitment to the security, availability and privacy of our products and protection of customer data.

Additional information can be found at: https://www.aicpa.org/

Customers can request the Behavox ProcessUnity (CyberGRX) report for third-party supplier due diligence. This Tier 2 validated cyber risk assessment provides insights into our security posture and risk management practices. Access the latest report directly from ProcessUnity using the following page.

Due diligence
security risk assessment

The assessment details

Methodology

Third-party CyberGRX report provides a standardized vendor assessment survey, analysis and reporting based on the National Institute of Standards and Technology (NIST) SP 800-53 and International Organization for Standardization (ISO)/International Electrotechnical Commission (IEC) 27001 frameworks.

The assessment features five control groups:

  • Strategic
  • Operations
  • Core
  • Management
  • Privacy

The aforementioned groups include controls and sub-controls based on the following frameworks: SOC, ISO 27001, NIST 800-53, NIST 800- 171, NY-DFS, PCI DSS, FFIEC, SIG, and more

Remote and On-Site Validation

Remote and On-Site validation requires a third party to provide CyberGRX Analysts with evidence artifacts that support their assessment answers.

This validation process proceeds as follows:

  • Selection of Controls
  • Evidence Request and Collection
  • Evidence Submission
  • Evidence Evaluation

Framework Mapping

Upon registration to CyberGRX platform our customers will be able to request the latest completed Risk Assessment report and map the assessment results to industry frameworks as well as custom frameworks to gain granular visibility into controls coverage.

The mapped frameworks are including but not limited to the following:

  • Cybersecurity Maturity Model Certification (CMMC) Level 5
  • National Institute of Standards and Technology (800.53 Revision 5 & CSF)
  • Cloud Security Alliance (CSA-CCM & CAIQ)
  • MITRE ATT&CK Framework
  • California Consumer Privacy Act (CCPA)
  • General Data Protection Regulation (GDPR)
  • NYDFS Cybersecurity Regulation (23 NYCRR 500)
  • Threat Profile: Accellion File Transfer Application Breach
  • LogJam (CVE-2021-44228)