Cleared by IT, workable for agencies

What Cadenta's SOC 2 report covers, and where our data lives

SOC 2 Type II, audited annually, covering security and availability. Data sits in the region you pick at signup. Here is the scope, the regions, what happens on exit, and which plans carry SCIM.

Published Oct 8, 2026 · Cadenta

What the report covers

SOC 2 Type II across the security and availability trust service criteria, covering a twelve-month observation window, audited annually by an independent firm. The current report covers the period ending 30 June 2026.

Confidentiality, processing integrity and privacy are not in scope. A reviewer who needs those criteria will not find them in this report, and no amount of reading will change that.

The full report is available under NDA. A summary covering scope, period, auditor and exceptions is available without one.

Where data lives

The region is set once, at signup, and is not changed afterwards without a migration. Backups stay inside the chosen region. Support staff access production from any region, which is the one case where data is read outside it, and that access is logged per session.

Regions and what is stored where
Region	Primary store	Backups	Chosen
US	us-east	us-west	default
EU	eu-central	eu-west	at signup
AU	au-southeast	au-southeast	at signup

What happens when you leave

An export of every project, issue, comment and attachment is available at any time, in JSON and CSV, without contacting anyone.

On cancellation the account is readable for 30 days and then deleted. Backups age out on a 35-day cycle, so the last copy is gone within 65 days of cancellation. A deletion certificate is issued on request after the cycle completes.

Access control by plan

Identity and provisioning
	Team	Business	Enterprise
SSO via SAML	yes	yes	yes
SCIM provisioning	no	yes	yes
Enforced two-factor	yes	yes	yes
Session and access logs	30 days	1 year	1 year
Audit log export	no	yes	yes

What a reviewer usually asks next

Subprocessors. A current list is published, with 30 days notice before any addition.
Penetration testing. Annual, by a third party, summary available under NDA.
DPA. Signed without an enterprise contract, on every plan including Team.
Breach notification. 72 hours, written into the DPA rather than a policy page.

Frequently asked questions

What does Cadenta's SOC 2 report actually cover?

SOC 2 Type II across security and availability, over a twelve-month observation window, audited annually by an independent firm; the current report covers the period ending 30 June 2026. Confidentiality, processing integrity and privacy are not in scope. The full report is available under NDA and a scope summary without one.

Can we choose which region Cadenta stores our data in?

Yes, at signup: US, EU or AU. Backups stay within the chosen region. The region is not changed afterwards without a migration. Support staff access production from any region, logged per session, which is the one case where data is read outside the chosen region.

What happens to our data when we leave?

A full export in JSON and CSV is available at any time without contacting anyone. After cancellation the account stays readable for 30 days then is deleted, and backups age out on a 35-day cycle, so the last copy is gone within 65 days. A deletion certificate is issued on request once the cycle completes.