Trust & Security

Built for enterprise scale and scrutiny.

1st90 runs behavioral execution for tens of thousands of employees at global enterprises. Here is how we protect their people and their data.

SOC 2 compliant
Controls

The controls your review will ask about.

Six domains, stated plainly. Everything here is confirmed internally and can be evidenced on request.

Data protection

Client and participant data is encrypted at every stage, and the environment it sits in is documented down to the region.

  • Encryption in transit. All traffic between a participant's browser, our platform and the database is encrypted with TLS 1.2 or higher. Unencrypted connections are refused.
  • Encryption at rest. Stored records, uploaded files and backups are encrypted with AES-256. Keys are managed by the hosting provider's key service and never leave it.
  • Hosting provider and region. We run on a major enterprise cloud provider, and the provider and data region are stated in writing for each engagement before contract signature.
  • Backups. Encrypted backups are taken on a scheduled basis and restore is tested, not assumed.

Access and identity

Access is limited to the people who need it to run the program, and every privileged action is attributable to a named person.

  • Single sign on. Enterprise SSO supports SAML and OIDC, so participants sign in through your identity provider and access follows your existing joiner, mover and leaver process.
  • Least access. Role based access separates client program owners, administrators and our own staff. Nobody sees more than their role requires.
  • Privileged access. Administrative access is individually named, protected with multi-factor authentication, and logged.
  • Reviews. Access is reviewed on a regular cycle and revoked when an engagement ends or a person leaves.

Compliance

1st90 is SOC 2 compliant. We support customer and partner security reviews, and documentation is available on request.

  • SOC 2. Our controls are aligned to SOC 2, and our current report status and scope are shared under NDA as part of a security review.
  • Security questionnaires. We complete customer and partner questionnaires, including CAIQ style assessments, and answer in writing rather than with a link.
  • Evidence. Where a control is claimed, the evidence behind it is available to your reviewers.

Privacy

Participant data is collected for one purpose, held under the client's control, and governed by a contract that privacy teams can sign.

  • GDPR approach. For participant data we act as a processor under your instructions. For our own business records we act as a controller. Our approach covers lawful basis, data minimisation, retention and data subject requests.
  • Data processing agreement. A DPA is available and executed as part of onboarding. If your team has its own standard terms, we review them rather than require ours.
  • Subprocessors. A current subprocessor list is provided at review, and changes are notified in advance with the right to object.
  • Requests and deletion. Access, correction and deletion requests are handled within the contractual window, and data is deleted or returned at the end of an engagement.
Kyper Shift Privacy PolicyKyper Studio Privacy Policy

Behavior data

The platform measures behavior to show organizational change. How individual records are used is a deliberate design decision, not a default.

  • Individual level handling. Participant level progress exists so a program can be run and supported. It is visible to the named client program owners you designate, and it is not used by us for performance evaluation of any individual.
  • Reporting level. Dashboards and outcome reporting default to cohort, role and region level, which is what leadership needs to see change.
  • Your controls. Program owners decide who can see participant level detail, and that permission is scoped and revocable.
  • No secondary use. We do not sell participant data, and we do not use it to train models or for any purpose beyond running and measuring your program.

Security reviews

We expect to be reviewed, and we run the process so it does not become the reason a program slips.

  • Questionnaires. Answered in writing by our security lead, with follow up calls where a reviewer wants detail.
  • Architecture walkthrough. A data flow and architecture session for your security or IT team before rollout.
  • Documentation under NDA. The full pack, including encryption, retention and incident response detail, is released under NDA.
Documentation

Everything a review needs, in writing.

Security documentation is provided under NDA during procurement, so your reviewers get current detail rather than a marketing summary. Ask for the full pack and we will send it with an owner named for each item.

Data Processing Agreement

Our standard DPA, ready to execute at onboarding, with terms available for review in advance.

Subprocessor list

The current list of subprocessors, the purpose of each, and advance notice of any change.

SOC 2 status and control summary

Our current SOC 2 status and the control areas it covers, shared under NDA.

Security architecture and data flow

How data moves from participant device to reporting layer, including integrations and boundaries.

Encryption and key management

Cipher standards in transit and at rest, key custody, and backup encryption.

Retention and deletion

Retention periods by data type, deletion on request, and what happens at contract end.

Security questionnaire responses

Completed questionnaires, including CAIQ style assessments, answered in writing by our security lead.

Incident response and continuity

How we detect, contain, notify and review a security incident, plus business continuity.

Request the security pack

Include your review timeline and we will match it.

Need our security documentation?

Request security documentation