EasyVirtualFair powers virtual career fairs for universities, governments and Fortune 500 employers. Our platform runs on SOC 2 Type II and ISO 27001 certified infrastructure, and our internal security program is aligned with SOC 2 Trust Service Criteria, ISO 27001 controls, and GDPR.
Our practices are mapped to the same Trust Service Criteria used by SOC 2 auditors and to the Annex A controls of ISO/IEC 27001:2022.
Encryption in transit (TLS 1.3) and at rest (AES-256). MFA enforced. Least-privilege access. Centralized logs.
Global CDN, redundant hosting, automated backups and a documented incident response process.
Customer data is logically segregated. Access is signed, audited and reviewed quarterly.
Validated forms, signed payment links via Stripe, and webhook reconciliation across our automation stack.
GDPR & CCPA aligned. Granular consent. EU data residency available on request for European clients.
We are transparent about what is certified, what is in progress, and what is inherited from our infrastructure providers.
Our security program is designed and operated in alignment with the SOC 2 Trust Service Criteria (Security, Availability, Confidentiality).
SOC 2 Type I — readiness in progressInternal controls mapped to ISO/IEC 27001:2022 Annex A — including access control, cryptography, supplier security and incident management.
AlignedLawful basis, DPAs, sub-processor list, EU data residency option, and granular consent management for attendees.
AlignedAll card payments are processed by Stripe (PCI DSS Level 1). EasyVirtualFair never stores card data on its own systems.
Inherited via StripeA summary of the technical and organizational controls in place. The full control matrix is available on request.
Short answers for procurement, legal and IT teams.
SOC 2 is not a certification — it is an attestation report issued by a CPA firm. Our internal program is aligned with the SOC 2 Trust Service Criteria, and our SOC 2 Type I audit is in progress. Our hosting providers (Netlify, Google Cloud) are SOC 2 Type II audited. Email security@easyvirtualfair.com to request our current status letter.
Our information security program is mapped to ISO/IEC 27001:2022 Annex A controls, but EasyVirtualFair is not currently certified as a company. Our infrastructure providers (Netlify, Stripe, Google Cloud) are ISO 27001 certified, which covers hosting, payments and identity layers.
Default hosting is via Netlify and Google Cloud. EU data residency is available on request for European clients — we will deploy your event into EU regions and sign the corresponding DPA.
All card payments are processed by Stripe (PCI DSS Level 1). Card numbers, CVCs and full PANs never touch EasyVirtualFair systems.
Yes. Email security@easyvirtualfair.com and we will send our Security Overview, sub-processor list and SOC 2 progress letter under NDA.
We follow a documented incident response plan: detect, contain, eradicate, recover and notify. Affected customers are notified within the timelines required by GDPR (72 hours for personal data breaches) and by their own contractual SLAs.
Procurement questionnaire, vendor risk review, DPA, or a copy of our Security Overview — we usually reply within one business day.