Posture verified in real time
Horizon's security, in plain sight.
Operational trust for teams that can't afford surprises: active certifications, verifiable controls and auditable evidence — all in one place.
Trust Center · continuous monitoring by Vanta
Explore the live Trust CenterControls, policies and evidence, updated automatically.
Material incidents — since 2024
Production uptime target
Incident triage SLA
Automated white-box pentest
Subprocessors, all certified
Recovery time objective (RTO)
Reference frameworks
What we measure ourselves against
SOC 2 Type II
Johanson LLP · report available under NDA
GDPR / LGPD
Active compliance program · EU and Brazil
CCPA
Active compliance program · California, US
NIST AI RMF
Govern · Map · Measure · Manage
OWASP LLM Top 10
Product guardrails for generative AI
NIST CSF
Identify · Protect · Detect · Respond · Recover
ISO/IEC 27001
Gap analysis complete · no certification date yet
ISO/IEC 42001
Gap analysis complete · AI governance
Technical controls
ISMS — key points
| Domain | Key control | Evidence |
|---|---|---|
| Access reviews | Quarterly certification of privileged groups | Completed reviews log |
| Password policy | ≥8 characters, complexity, MFA, 90-day rotation | Policy §3.7.5 |
| Vulnerability management | AWS Inspector + Shannon, continuous; critical ≤24h, high ≤7 days | Internal dashboard |
| Logging & SIEM | CloudWatch + GuardDuty + Sentry + Dash0 (observability: logs, metrics, traces), 24×7 on-call (OnCall), 365-day retention | Configuration (internal) |
| Change management | PRD (Sales/CS) → weekly prioritization (Product) → sprint (Tech) → Release Changelog | Change Request Procedure |
| Device management (MDM) | Iru (formerly Kandji) | Device compliance status |
| Risk management | Risk register scored by likelihood and impact, reassessed annually | Risk register (internal) |
| Security incidents (regulatory) | Documented response plan; identification, reporting and notification per procedure | Incident Response Plan |
| Cyber insurance | Cyber Liability + Technology E&O, US$1M aggregate (Vouch · United Specialty), in force through Sep 2027 | Cybersecurity Insurance Policy |
Document library
Documentation
Under NDA · each document opens its current version.
Policies & procedures
Audits, plans & evidence
- SOC 2 Type II Report
- SOC 2 Audit Engagement Letter
- Strike Pentest Summary
- DPA — Data Processing Agreement
- Incident Response Plan
- Personal Data Breach Response Plan
- Latest Incident Report & RCA
- Backup & Recovery Plan
- Tabletop DR Exercise Report
- Proof of Completed Access Reviews
- Physical Visitors Logs
- Annual Firewall Review
Third parties
Subprocessors / Vendors
8 of 8 with a signed DPA and current certification.
| Subprocessor | Role | Certification | DPA |
|---|---|---|---|
| Amazon Web Services | Hosting / Compute | SOC 2 / ISO 27001 | Signed |
| Microsoft Azure | Hosting | SOC 2 / ISO 27001 | Signed |
| Anthropic | LLM model | SOC 2 | Signed |
| OpenAI | LLM model / Embeddings | SOC 2 | Signed |
| Neo4j | Graph database | SOC 2 / ISO 27001 | Signed |
| Vercel | Frontend / CDN | SOC 2 | Signed |
| Sentry | Error monitoring | SOC 2 | Signed |
| Vanta | Compliance / internal monitoring | SOC 2 | Signed |
Need a document under NDA, or have a specific question?
Horizon's Responsible AI Owner and DPO answers directly — no generic forms, no week-long waits.