Security and compliance
The security pack
For: Compliance, IT
Our SOC 2 Type 1 report and Security Pack are available now: email [email protected].
What exists now. A SOC 2 Type 1 report, completed May 2026, shared under NDA. The BestPair Security Pack, covering our security controls and compliance status. The Data Processing Addendum, covering how your data is used and deleted.
What's next. A SOC 2 Type 2 report is shared under NDA once issued.
If your review needs a security questionnaire completed, send it over and we'll work through it with you.
In short: we never ask for consumer names, Social Security numbers, phone numbers, email or street addresses, or bank details. If a file includes any, we delete it and ask for a resend. Files move by encrypted SFTP, never email. Your data is used to deliver your work, and deleted within 30 days after the engagement ends, with backups cleared on the schedule in the Data Processing Addendum. BestPair keeps the models trained on your data, as Standard Terms 5.2 sets out. Where it is stored is set out there too.
No separate NDA is needed to start: the Order Form and Addendum cover confidentiality. If you want one first, to read our SOC 2 report, we'll sign a short mutual NDA.