# Vistaly Privacy & Security Fact Sheet

**Last Updated: April 2026**

## Key Documents & Resources

### Public Documentation

- 🔒 [Security Policy](/content/security/index.html) 
- 📜 [Privacy Policy](/content/privacy-policy/index.html) 
- 📋 [Terms of Service](/content/terms-of-service/index.html) 
- 🌐 [GDPR Compliance](/content/gdpr-compliance/index.html) 
- 🏢 [Sub-Processors](/content/sub-processors/index.html) 
- 🍪 [Cookie Policy](/content/cookie-policy/index.html) 
- 📊 [System Status](https://status.vistaly.com/)

### Available Upon Request

- **SOC 2 Type 2 Report** 
- **Data Privacy Framework Verification** - Search "Vistaly" on [DPF List](https://www.dataprivacyframework.gov/s/participant-search)

### Business Plan Added Support

Business & Enterprise customers receive additional security support including:

- **Data Processing Agreement (DPA)**  
- **Security Architecture Walkthroughs** 
- **Custom Security Assessments**  
- **Standard Contractual Clauses (SCCs)**  
- **Dedicated Security Reviews** 
- **Custom Legal Agreements**

### Quick Reference

✓ SOC 2 Type 2 Certified  
✓ GDPR Compliant  
✓ EU-U.S. Data Privacy Framework Certified  
✓ Data Residency: US or EU (customer-selected)  
Infrastructure: AWS US & EU regions (SOC 1/2/3, ISO 27001/27017/27018/27701)

Security Contact: [security@vistaly.com](mailto:security@vistaly.com)  
Data Protection Officer: [dpo@vistaly.com](mailto:dpo@vistaly.com)

## 1. Data Privacy & Rights

### 1.1 Your Data Ownership

- **You own your data**  
- Full intellectual property rights remain with you  
- License terminates upon content/account deletion  
→ See data ownership terms in our [Terms of Service: Data Ownership section](/content/terms-of-service#data-ownership-and-access/index.html)

### 1.2 Who Can Access Your Data

#### Our Employees

- Access granted on least-privilege basis only  
- All employees bound by confidentiality agreements  
- Multi-factor authentication required  
→ See full employee security requirements at [Security Policy: Internal Security Measures](/content/security#internal-security-measures/index.html)

#### Third-Party Sub-processors

We maintain transparency about our sub-processors. Key processors include AWS (infrastructure), Stripe (payments), and select analytics/monitoring services.  
→ Full list with compliance status at [Sub-Processors](/content/sub-processors/index.html)

### 1.3 Your Control & Rights

- Export your data anytime  
- Delete your account or organization data  
- Full GDPR rights: access, correction, deletion, portability, restriction  
→ See detailed data control procedures at [Privacy Policy: Your Rights section](/content/privacy-policy#your-rights-controlling-personal-information/index.html)

### 1.4 Geographic Data Processing & Data Residency

- **Data Residency:** Customers choose their data region (United States or European Union) during account creation. This choice is permanent.
- **Primary Infrastructure:** AWS us-east-1 (US) or AWS eu-west-1 (EU), based on customer selection.
- **International Transfers:** Covered by DPF certifications, Standard Contractual Clauses (SCCs), and Data Processing Agreements (DPAs)

## 2. Data Security

### 2.1 Encryption

- **At Rest:** AES-256 encryption for all stored data  
- **In Transit:** TLS 1.2+ for all data transmission  
- **Key Management:** Enterprise-grade AWS KMS

### 2.2 Access Controls

- Single Sign-On (SSO) via Google OAuth  
- Multi-factor authentication available  
→ See complete access control specifications at [Security Policy: Access & Identity Control](/content/security#access-identity-control/index.html)

### 2.3 Infrastructure Security

- AWS certified infrastructure (SOC 1/2/3, ISO 27001/27017/27018/27701)  
→ See infrastructure security details at [Security Policy: Cloud Security](/content/security#cloud-security/index.html)

### 2.4 Security Monitoring

- Real-time monitoring and alerting  
- Regular vulnerability scanning  
→ See monitoring practices at [Security Policy: Security Monitoring](/content/security#security-monitoring/index.html)

### 2.5 Incident Response

- **Security Issues:** [security@vistaly.com](mailto:security@vistaly.com)  
- **Data Breaches:** GDPR-compliant 72-hour notification  
→ See incident response procedures at [Security Policy: Incident Response](/content/security#incident-response/index.html)

### 2.6 Backup & Recovery

- Daily automated backups  
→ See backup and disaster recovery details at [Security Policy: Data Protection](/content/security#data-protection/index.html)

## 3. Data Isolation

### 3.1 Architecture

- Workspace-level separation with distinct access controls  
- No cross-workspace data access  
- Separate authentication per organization

### 3.2 Customer Data Segregation

Vistaly implements comprehensive data isolation to ensure complete separation between customer organizations.

## 4. Compliance & Assurance

### 4.1 Active Certifications

| Certification              | Scope                                                  | Verification                   |
|---------------------------|------------------------------------------------------|-------------------------------|
| SOC 2 Type 2             | Security, Availability, Confidentiality               | Available on request          |
| GDPR                      | Full compliance                                      | [Policy](/content/gdpr-compliance/index.html)  |
| EU-U.S. DPF              | Data transfers                                       | [Certificate](https://www.dataprivacyframework.gov/s/participant-search)  |
| UK Extension DPF         | UK transfers                                         | [Certificate](https://www.dataprivacyframework.gov/s/participant-search)  |

### 4.2 Third-Party Validation

- Independent SOC 2 Type 2 audit  
- Regular penetration testing

### 4.3 Contractual Commitments

- **All Customers:** Data Privacy Framework certification  
- **Business Customers:** Custom Data Processing Agreements

## 5. Operational Security

### 5.1 Development Security

- Mandatory code review process  
→ See development practices at [Security Policy: Internal Security Measures](/content/security#internal-security-measures/index.html)

### 5.2 Employee Security

- Security training and policy acknowledgment required  
→ See employee security requirements at [Security Policy: Internal Security Measures](/content/security#internal-security-measures/index.html)

### 5.3 Vendor Management

- Risk assessments before data sharing  
→ See vendor management procedures at [Security Policy: Vendor Management](/content/security#vendor-management/index.html)

### 5.4 Business Continuity

- Daily automated backups with 30-day retention  
→ See business continuity details at [Security Policy: Data Protection](/content/security#data-protection/index.html)

### 5.5 Security Governance

- Designated Data Protection Officer  
→ See governance structure at [Security Policy: Security Governance](/content/security#security-governance/index.html)

## Contact Us

### For Immediate Needs

- **Security Concerns:** [security@vistaly.com](mailto:security@vistaly.com)  
- **Data Protection:** [dpo@vistaly.com](mailto:dpo@vistaly.com)

This document provides a high-level overview of Vistaly's security and privacy practices for customer evaluation. For detailed technical specifications, please refer to the linked policies or contact our security team.