Certified where it counts.
Independent certifications back the controls behind your deposit. EscrowTech maintains SOC 2 and ISO 27001, so the way we handle your materials is audited, not just asserted.
What we're certified for.
Two independent standards that speak to how we secure and operate the systems holding your deposit.
Controls, examined over time.
- Security controls protecting the systems that hold deposits
- Availability of those systems, so materials stay reachable
- Confidentiality of the materials you deposit with us
Security, managed as a system.
- A documented information security management system (ISMS)
- Risk assessment and treatment across the organization
- Certified by an accredited body, reviewed on a cycle
Audited, not just asserted.
Certifications turn "trust us" into something a risk or procurement team can actually verify.
Hand your risk and procurement teams independent reports, not assurances, when they evaluate the dependency.
The handling of your deposit sits inside an audited control environment, reviewed on a regular cycle.
Many enterprise and regulated buyers require these certifications from a vendor before they will sign.
Certifications cover how we operate. Verification covers whether your specific deposit would actually recover.
Certifications cover how we operate. See security → · Verification covers your specific deposit. See verification →
Two vaults. One in a granite mountain.
Deposits are held in two physical, US-based vaults, one inside a granite mountain, monitored around the clock. The provider has to satisfy the people who approve the deal, and EscrowTech is the one their legal teams already recognize.
Certifications, answered.
The questions risk, procurement, and security teams ask most often.
What certifications does EscrowTech hold?
EscrowTech maintains SOC 2 and ISO/IEC 27001. Together they cover how we secure and operate the systems that hold your deposit, examined by an independent auditor rather than asserted by us.
What does SOC 2 cover?
SOC 2 is an independent examination of our controls against the Trust Services Criteria, including security, availability, and confidentiality. A Type II report covers how those controls operated over a period of time, not just at a single moment.
What does ISO 27001 cover?
ISO/IEC 27001 certifies our information security management system: the documented way we identify risk and apply controls to protect information across the organization. Certification is issued by an accredited body after an audit.
Why do certifications matter for software escrow?
Escrow only helps if the materials are still there, intact, and handled correctly when you need them. Certifications give your risk and procurement teams independent evidence that the environment holding your deposit is run to a recognized standard.
Can my procurement or security team verify them?
Yes. Ask us for the SOC 2 report and the ISO 27001 certificate, and your team can review them as part of a vendor or security assessment. That is the point of holding them: they are meant to be checked, not taken on faith.
Are the controls independently audited or self-asserted?
Independently audited. SOC 2 is examined by an independent auditor and ISO 27001 is certified by an accredited body. Neither is a self-assessment, which is the difference between audited and asserted.
Where are deposits stored?
Deposits are held in two physical, US-based sites, monitored around the clock, with a documented chain of custody. Two-site US storage keeps your materials recoverable even if one location is unavailable.
How do I request the reports?
Tell us what your risk team needs through the form on this page or your EscrowTech contact. We will share the current SOC 2 report and ISO 27001 certificate and walk you through the scope and dates.
Make it safe to depend on.
Tell us what your risk team needs. We'll share the right reports and walk you through them.
Thanks, we've got it.
A member of our team will be in touch shortly.