Security
Security at Keeper
built for sensitive social care data
Helplines and social services organizations trust Keeper with conversations that often include personal and health information. Here is how we protect that data. Our security policies and SOC 2 report are available in our Trust Center.
Last reviewed October 2026
SOC 2 Type II
CompliantIndependently audited by Advantage Partners, a CPA firm, against the AICPA Trust Services Criteria for security. The audit covered May 18 to August 18, 2026.
- Report
- Type II
- Criteria
- Security
- Opinion
- Clean
- Exceptions
- None
HIPAA
ReadyWe follow HIPAA safeguards so protected health information stays private, secure, and handled with care.
Audited providers
Our cloud hosting and database providers maintain their own SOC 2 Type II reports, which we review at least annually.
How we protect data
Safeguards across
our platform and team
Responsible AI
Keeper never uses customer data to train AI models. Requests to our AI model providers travel over encrypted connections and are governed by data processing agreements.
Encryption
Data is encrypted in transit over HTTPS and at rest with AES-256, including backups. Row-level security is enforced on every table in our application database.
U.S. data storage
Application data is stored in the United States on infrastructure from SOC 2 Type II audited cloud providers.
Access control
Staff sign in with single sign-on and multi-factor authentication. Access follows least privilege and is reviewed quarterly. Every employee completes a background check and security training.
Monitoring
We log and monitor system activity and uptime, and continuously scan our code and dependencies for vulnerabilities and exposed secrets.
Incident response
A documented incident response plan, including customer notification procedures, guides how we handle any security or privacy event.
Questions
Have a security
questionnaire?
Our Trust Center has our security policies and SOC 2 Type II report, available on request. For security reviews or questions, or to report a vulnerability, email security@usekeeper.com.