Internal — draft, not yet published. Remove this banner before making public (see ISMS-DOC-07-8 §4).
Security at Soon¶
Soon helps organisations plan and manage their workforce — scheduling, time and attendance, leave, and AI-assisted forecasting. Because that means handling your employees' data, we've built security into how the product and the company operate. This page explains how we protect your information and where to go for more.
Questions any time: security@soon.works
At a glance¶
| Hosting | Amazon Web Services, EU (Ireland) — your data stays in the European Union |
| Encryption | TLS 1.2+ in transit · AES-256 at rest |
| Access | Least privilege · MFA on administrative access · quarterly reviews |
| Monitoring | 24/7 automated threat detection, logging and alerting |
| Assurance | SOC 2 Type 1 and ISO/IEC 27001 both in progress |
| Data role | Soon is a GDPR data processor; you remain the controller |
Compliance and independent assurance¶
We're completing formal, independently-assessed security programmes:
- SOC 2 Type 1 (Security) — examination in progress with an independent auditor.
- ISO/IEC 27001:2022 — certification in progress.
- Independent penetration test — part of the same programme.
We'll share the SOC 2 report and ISO certificate here as soon as they're issued. Until then, we don't describe ourselves as certified — you'll only ever see accurate status from us.
Our infrastructure provider, AWS, is independently certified to ISO 27001, SOC 1/2/3 and PCI DSS.
How we protect your data¶
Your data stays in the EU. The platform runs on AWS in eu-west-1 (Ireland) and your data is stored in the European Union. A small number of supporting providers are based outside the EU; each is listed below and covered by Standard Contractual Clauses.
Encryption everywhere. Everything is encrypted in transit (TLS 1.2 or higher) and at rest (AES-256).
Strict access control. Our team works on a least-privilege basis, multi-factor authentication is required for administrative access to production, and we review who has access every quarter. People joining or leaving follow a controlled process.
Always-on monitoring. We run centralised logging, application error monitoring and continuous automated threat detection, with alerts going straight to our security team.
Secure by development. Every change to the product is peer-reviewed and passes automated security testing — including dependency and secrets scanning — before it can reach production. Development, staging and production are kept separate.
Backups and resilience. Your data is backed up automatically to encrypted, retained snapshots on AWS's redundant infrastructure.
Prepared for incidents. We maintain a documented incident-response process. As a GDPR processor, if a personal-data breach affects you we notify you without undue delay, so you can meet your own 72-hour obligation.
A security-minded team. Everyone at Soon is bound by confidentiality agreements, completes security-awareness training with quarterly refreshers, and works under documented policies. We're fully remote with no offices; everything runs in the cloud.
Signing in to Soon¶
Soon supports enterprise single sign-on (SAML) with Microsoft Entra ID, Okta and Google Workspace, as well as Google and Microsoft social login.
For accounts that use an email and password, a built-in second factor isn't available yet — if you want MFA today, use SSO or social login, which apply your own identity provider's MFA. Native MFA for email/password sign-in is on our roadmap.
Sub-processors¶
We rely on a small set of vetted providers to run the service:
| Provider | Purpose | Region |
|---|---|---|
| Amazon Web Services | Infrastructure, hosting and transactional email | EU (Ireland) |
| Cloudflare | DNS, content delivery and web hosting | Global edge |
| Stripe | Payments and billing (PCI DSS Level 1) | EU / US (SCCs) |
| WorkOS | Enterprise single sign-on | US (SCCs) |
| PostHog | Product analytics | EU |
| Sentry | Application error monitoring | Per current agreement |
| Intercom | Customer support | US (SCCs) |
| Cloudinary | Image and media hosting | EU / US |
| OpenAI | AI features in the product | US (SCCs) |
| Google Maps Platform | Address lookup in the app | Global |
| Google Workspace | Internal collaboration | EU / global |
Some integrations — calendar sync and contact-centre platforms among them — are connected only when you switch them on, so they apply to your tenant rather than to every customer. These are set out in your agreement.
We tell customers about material changes to this list, and current data-processing agreements are available on request.
Your data, your control¶
We keep your data for as long as your contract runs, and delete it within 90 days after it ends; backup copies then expire on their normal cycle. You can request an export or deletion of your data at any time, in line with your agreement and the GDPR.
Legal¶
Found a security issue?¶
We welcome reports from security researchers. Email security@soon.works — we investigate every report and will acknowledge yours. Please give us reasonable time to fix an issue before disclosing it publicly, and don't access or change data that isn't yours while testing.
Need more detail?¶
Evaluating Soon for your organisation? Under a mutual NDA we can share our Security Overview, specific policies, our sub-processor list and data-processing agreements, and — once issued — our SOC 2 report. Just email security@soon.works and we'll set you up.
For questions about anything on this page, contact security@soon.works.