Vistaly Privacy & Security Fact Sheet
Last Updated: April 2026
Key Documents & Resources
Public Documentation
- 🔒 Security Policy
- 📜 Privacy Policy
- 📋 Terms of Service
- 🌐 GDPR Compliance
- 🏢 Sub-Processors
- 🍪 Cookie Policy
- 📊 System Status
Available Upon Request
- SOC 2 Type 2 Report
- Data Privacy Framework Verification - Search "Vistaly" on DPF List
Business Plan Added Support
Business & Enterprise customers receive additional security support including:
- Data Processing Agreement (DPA)
- Security Architecture Walkthroughs
- Custom Security Assessments
- Standard Contractual Clauses (SCCs)
- Dedicated Security Reviews
- Custom Legal Agreements
Quick Reference
✓ SOC 2 Type 2 Certified
✓ GDPR Compliant
✓ EU-U.S. Data Privacy Framework Certified
✓ Data Residency: US or EU (customer-selected)
Infrastructure: AWS US & EU regions (SOC 1/2/3, ISO 27001/27017/27018/27701)
Security Contact: security@vistaly.com
Data Protection Officer: dpo@vistaly.com
1. Data Privacy & Rights
1.1 Your Data Ownership
- You own your data
- Full intellectual property rights remain with you
- License terminates upon content/account deletion
→ See data ownership terms in our Terms of Service: Data Ownership section
1.2 Who Can Access Your Data
Our Employees
- Access granted on least-privilege basis only
- All employees bound by confidentiality agreements
- Multi-factor authentication required
→ See full employee security requirements at Security Policy: Internal Security Measures
Third-Party Sub-processors
We maintain transparency about our sub-processors. Key processors include AWS (infrastructure), Stripe (payments), and select analytics/monitoring services.
→ Full list with compliance status at Sub-Processors
1.3 Your Control & Rights
- Export your data anytime
- Delete your account or organization data
- Full GDPR rights: access, correction, deletion, portability, restriction
→ See detailed data control procedures at Privacy Policy: Your Rights section
1.4 Geographic Data Processing & Data Residency
- Data Residency: Customers choose their data region (United States or European Union) during account creation. This choice is permanent.
- Primary Infrastructure: AWS us-east-1 (US) or AWS eu-west-1 (EU), based on customer selection.
- International Transfers: Covered by DPF certifications, Standard Contractual Clauses (SCCs), and Data Processing Agreements (DPAs)
2. Data Security
2.1 Encryption
- At Rest: AES-256 encryption for all stored data
- In Transit: TLS 1.2+ for all data transmission
- Key Management: Enterprise-grade AWS KMS
2.2 Access Controls
- Single Sign-On (SSO) via Google OAuth
- Multi-factor authentication available
→ See complete access control specifications at Security Policy: Access & Identity Control
2.3 Infrastructure Security
- AWS certified infrastructure (SOC 1/2/3, ISO 27001/27017/27018/27701)
→ See infrastructure security details at Security Policy: Cloud Security
2.4 Security Monitoring
- Real-time monitoring and alerting
- Regular vulnerability scanning
→ See monitoring practices at Security Policy: Security Monitoring
2.5 Incident Response
- Security Issues: security@vistaly.com
- Data Breaches: GDPR-compliant 72-hour notification
→ See incident response procedures at Security Policy: Incident Response
2.6 Backup & Recovery
- Daily automated backups
→ See backup and disaster recovery details at Security Policy: Data Protection
3. Data Isolation
3.1 Architecture
- Workspace-level separation with distinct access controls
- No cross-workspace data access
- Separate authentication per organization
3.2 Customer Data Segregation
Vistaly implements comprehensive data isolation to ensure complete separation between customer organizations.
4. Compliance & Assurance
4.1 Active Certifications
| Certification | Scope | Verification |
|---|---|---|
| SOC 2 Type 2 | Security, Availability, Confidentiality | Available on request |
| GDPR | Full compliance | Policy |
| EU-U.S. DPF | Data transfers | Certificate |
| UK Extension DPF | UK transfers | Certificate |
4.2 Third-Party Validation
- Independent SOC 2 Type 2 audit
- Regular penetration testing
4.3 Contractual Commitments
- All Customers: Data Privacy Framework certification
- Business Customers: Custom Data Processing Agreements
5. Operational Security
5.1 Development Security
- Mandatory code review process
→ See development practices at Security Policy: Internal Security Measures
5.2 Employee Security
- Security training and policy acknowledgment required
→ See employee security requirements at Security Policy: Internal Security Measures
5.3 Vendor Management
- Risk assessments before data sharing
→ See vendor management procedures at Security Policy: Vendor Management
5.4 Business Continuity
- Daily automated backups with 30-day retention
→ See business continuity details at Security Policy: Data Protection
5.5 Security Governance
- Designated Data Protection Officer
→ See governance structure at Security Policy: Security Governance
Contact Us
For Immediate Needs
- Security Concerns: security@vistaly.com
- Data Protection: dpo@vistaly.com
This document provides a high-level overview of Vistaly's security and privacy practices for customer evaluation. For detailed technical specifications, please refer to the linked policies or contact our security team.