The security posture, on one page.
Ultiblob is built for regulated workloads. This page documents the certifications, controls, and procurement artifacts your security team will ask for.
SOC 2 Type II
audit in progressTrust Services Criteria for security, availability, and confidentiality. Under NDA review available today.
HIPAA BAA
available on signatureBusiness Associate Agreement covering PHI workloads. Encryption, audit logging, RBAC, breach notification — by default.
PCI-DSS aware
controls in scopePCI-aware network segmentation, tokenization patterns, and quarterly scans available. SAQ-D supported.
ISO 27001
roadmapInformation security management system framework. Gap assessment completed Q1 2026.
The controls behind the certifications.
Encryption everywhere
AES-256 at rest on all storage tiers. TLS 1.3 in transit. BYOK and HSM-backed keys for Scale-tier customers.
Identity & access
MFA enforced for all employees. Just-in-time access for production. Quarterly access reviews. Customer SSO via SAML / OIDC.
Continuous monitoring
24/7 AI-operated NOC. Endpoint, network, and application telemetry to a SIEM. Auto-remediation for known signatures.
Vulnerability management
Daily container image scans. Quarterly external pen-tests. Monthly internal red-team exercises. CVE SLA: 24h critical, 7d high.
Audit & evidence
Every change reviewed, logged, and tied to a ticket. Change records retained 7 years. Customer-accessible audit log on request.
Data residency
Customer data never leaves DeSoto, TX or Flint, MI unless explicitly contracted. No cross-border replication without consent.
Everything your security team needs.
Email info@ultiblob.com with your DPA / security questionnaire and an NDA — we typically return everything within one business day.
Who else touches your data.
| Subprocessor | Role |
|---|---|
| Microsoft Corporation | Azure Local platform components |
| NVIDIA Corporation | GPU hardware (H100 / L40S) |
| Anthropic, PBC | Claude API for AI features |
| Cloudflare, Inc. | Edge, DDoS, DNS |
| Pure Storage, Inc. | Primary storage arrays |
| Veeam Software | Backup and replication |
Send the questionnaire. We'll send the artifacts.
Most procurement reviews close in 2-3 business days from the first email. Bring your DPA, your security questionnaire, and your NDA — we'll do the rest.