Our own questionnaire, filled out.

It would be strange to make you send us a spreadsheet. Here are the questions we’re asked most, answered the way Firstpass answers yours: with the source beside each one.

Our Head of Security signs off on this page. Last signed off 2 October 2026.

RefQuestionAnswerSourceStatus

E.1Certifications and audits

E.1.1Do you have a SOC 2 Type II report?
Yes. Audit period 1 Jun 2025 – 31 May 2026, issued 14 Jul 2026 by Abernethy Clarke LLP, with no exceptions noted.
Source: SOC 2 Type II report, p. 4, auditor's opinion
House answer
E.1.2Are you ISO 27001 certified?
No, and we don't plan to be before 2027. Our SOC 2 covers the Security and Confidentiality criteria.
Source: Security roadmap, H1 2027
House answer
E.1.3When was your last penetration test?
April 2026, external, by Northgate Labs. 0 high, 2 medium, 5 low findings. Both mediums fixed within 9 days.
Source: Pen test summary, Apr 2026, p. 2
House answer

E.2Your data

E.2.1Do you train models on our documents or answers?
No. Not ours, and not a model provider's. Every model call runs under a zero-retention agreement.
Source: DPA v3, §4.2
House answer
E.2.2Where is our data stored?
AWS us-east-1 by default. EU customers can choose eu-west-1 (Dublin) at signup.
Source: DPA v3, Annex 2
House answer
E.2.3Is data encrypted?
AES-256 at rest, keys in AWS KMS and rotated annually. TLS 1.2 or higher in transit.
Source: Information Security Policy v4.1, §7
House answer
E.2.4What happens to our data if we leave?
Deleted from production within 30 days and from backups within 35. We email you when it's done.
Source: DPA v3, §11.3
House answer
E.2.5Can we hold our own encryption keys?
Not yet. Planned for House, H1 2027.
Source: —
Open
Owner: Sam Achebe, Engineering

E.3Access

E.3.1What can Firstpass reach in our Drive, Notion, Confluence or Slack?
Only the folders, spaces and channels you select, read-only. In Slack, only channels you add the Firstpass app to.
Source: Integration scopes, docs §2
House answer
E.3.2Who at Firstpass can see our documents?
Two named support engineers, only after you grant time-limited access from your settings. Every access is logged and visible to you.
Source: Access Control Policy v2.3, §5.1
House answer
E.3.3Do you support SSO?
Yes, SAML 2.0 and SCIM on House. Google sign-in on Draft.
Source: Pricing, D.9
House answer

E.4Incidents

E.4.1How fast will you tell us about a breach affecting our data?
Within 48 hours of confirming it, by email to your named security contact.
Source: DPA v3, §8.1
House answer
E.4.2Have you had a reportable incident?
No.
Source: Incident register, reviewed 2 Oct 2026
House answer

E.5Subprocessors

E.5.1Amazon Web Services
Hosting, storage, key management
US (us-east-1), EU (eu-west-1)
E.5.2Model provider (named in DPA Annex 3)
Drafting answers, zero retention, no training
US
E.5.3Google Workspace
Email with customers
US
E.5.4Stripe
Billing
US

E.6Something we didn’t answer?

Email security@firstpass.example and our Head of Security will answer it. If it comes up twice, it goes in this table.