The evidence your InfoSec, legal, and procurement teams typically request about us as a vendor.
Published: privacy policy, cookie policy, sub-processor list, DPA template, and our trust badges. Available under NDA via Trust Center request: SOC 2 Type II report, ISO 27001 SoA, CAIQ Lite v4, pen test summaries, HIPAA BAA. Architecture, residency, retention, and disclosure timeline below. For Compliance program support (NIST 800-171 mapping, ITAR/CMMC evidence tooling), see /compliance.
What InfoSec and procurement review about us as a vendor.
These are Visitly's own attestations and legal artifacts, the inputs to your vendor risk review of us. Separate from Compliance Program Inputs below (which support your compliance program).
SOC 2 Type II
Annual audit by independent CPA firm. Full report available under NDA.
ISO 27001
Certified information security management system. Statement of Applicability available under NDA.
CSA STAR CAIQ Lite v4
Self-attestation answered for all 297 controls. Available on request under NDA.
DPA + Sub-processors
DPA template published. Sub-processor list published with change-notice cadence. Signed DPA executed at contract.
GDPR + CCPA
Standard Contractual Clauses + 72-hour breach notification. Privacy program data-handling commitments.
HIPAA BAA available
Visitly supports your covered-entity obligations through encryption, access controls, and a BAA executed at contract.
What we provide as inputs to your compliance program.
These are documents, references, and tooling Visitly offers to support the compliance programs you own, HIPAA, ITAR, CMMC, OSHA, NISPOM, FERPA. They're not attestations about Visitly; they're visitor-management inputs to your program. Your auditor / C3PAO / OCR submission / counsel reviews your program; we provide the visitor-side records.
NIST 800-171 Rev 2 control-mapping reference
Reference document for input to your CMMC Level 2 evidence package. Visitly's mapping; your C3PAO assessor reviews your program. Available under NDA.
ITAR / CMMC / NISPOM evidence tooling
Visitor-side controls (citizenship gating, escort workflow, audit trail) and per-tenant evidence export feed your regulated-area program.
OSHA evidence tooling
PPE attestation, hazard acknowledgment, and drill-mode rolls with one-click evidence export per audit window. Inputs to your OSHA program.
HIPAA program support
Visitor logs configurable to HIPAA Privacy Rule retention; BAA executed at contract. Your covered entity owns the program; we provide the visitor-management inputs.
What Visitly does. What you do.
Compliance is a program. Visitly is a tool inside that program. Here's where the boundary sits.
Captures visit records (photo, ID, signed acknowledgments, time-stamped)
Provides watchlist screening, citizenship gating, escort workflow, and presence tracking
Stores records in encrypted, region-pinned infrastructure with audit-log retention
Executes our SOC 2, ISO 27001, and pen-test programs and maintains the artifacts
Offers a BAA, DPA, and the evidence exports your compliance team brings to audits
Notifies you of sub-processor changes and security incidents
Define your site policies, restricted areas, and visitor-classification rules
Designate ITAR / CUI / regulated zones and your citizenship-gating policy
Own your HIPAA covered-entity, ITAR, CMMC, OSHA, FERPA, or other compliance program
Maintain administrator account hygiene and your IdP integration
Determine retention windows that meet your records-management obligations
Document your program for your auditor, C3PAO, OCR submission, or counsel
Visitly does not certify, attest, or guarantee your organization's compliance with any framework. We provide the visitor-management tooling, controls, and evidence that support the program your team designs and operates.
Encryption, residency, retention, and access, defaults that don't need an exception.
Encryption
TLS 1.3 in transit · AES-256 at rest · keys managed in AWS KMS with per-tenant rotation.
Retention
Set by your policy, per tenant. You decide how long audit events and visitor PII are kept.
Backup + recovery
Continuous point-in-time recovery · daily snapshots · 35-day backup retention · RPO 5 min · RTO 1 hour.
Access control (internal)
Least-privilege RBAC · MFA required for all engineering access · production access logged + reviewed quarterly.
Penetration testing
Annual third-party pen test (NCC Group most recent · 2025). Summary letter available under NDA.
Security disclosure
Report a vulnerability to security@visitly.io. Encrypt with our GPG key. We commit to the timeline below for every report.
GPG fingerprint
Report received
Triage complete
Severity-graded plan + ETA
Patch deployed (critical/high)
Public disclosure (if applicable)
Frequently Asked Questions
1. How does Visitly protect visitor data?
Visitor data is encrypted in transit and at rest. Access inside Visitly follows least privilege: all engineering access requires MFA, and production access is logged and reviewed every quarter. Visitly is SOC 2 Type II and ISO 27001 certified, and an independent firm runs a penetration test every year.
2. Why is data security important for modern visitor management systems?
Data security is important for visitor management systems because they process sensitive information such as visitor identities, access records, and workplace activity. Visitly goes beyond passive data collection by applying security controls that help organizations protect information and maintain compliant visitor workflows. Traditional sign-in systems often store visitor details without advanced security controls or monitoring capabilities. Visitly helps businesses strengthen workplace governance through secure records, controlled access, and automated compliance processes.
3. Which certifications does Visitly hold, and which programs does it support?
Visitly is SOC 2 Type II and ISO 27001 certified, GDPR and CCPA compliant, and HIPAA compliant, and it signs a BAA at contract. For programs you own, such as ITAR, CMMC, OSHA and FERPA, Visitly supplies the visitor records, controls and evidence exports. It does not certify your organization's compliance with any framework.
4. Where is our data stored, and for how long?
In the US by default, with EU or APAC region pinning available. Retention follows your own policy: you decide how long audit events and visitor personal data are kept, per tenant, and Visitly does not impose a period. Legal hold is available.
5. Does Visitly use encryption to protect visitor information?
Yes. Visitor information is encrypted in transit with TLS 1.3 and at rest with AES-256, with keys held in AWS KMS and rotated per tenant. Backups run as continuous point-in-time recovery with daily snapshots kept for 35 days, a 5-minute recovery point and a 1-hour recovery time.
6. Is Visitly GDPR compliant, and will it sign a DPA?
Yes. Visitly is GDPR and CCPA compliant and signs its own DPA at contract. The standard DPA is available to download, and larger deployments can negotiate changes to it with sales. We use Standard Contractual Clauses, commit to 72-hour breach notification and publish our sub-processor list.
7. How does Visitly help us prepare for a security audit?
For your own audit, every visit is time-stamped in an immutable audit log that you can search and export for the dates in question. For vendor review, one Trust Center request provides our SOC 2 Type II report, ISO 27001 Statement of Applicability, CAIQ Lite v4 and penetration test summary under NDA.
8. Can Visitly support enterprise security teams with visitor access controls?
Visitly supports enterprise security teams by providing visitor access workflows, verification processes, notifications, and centralized visibility. Unlike passive visitor systems, Visitly helps security teams actively manage visitor approvals, monitor activity, and enforce workplace access policies. The platform can support organizations across corporate offices, healthcare facilities, manufacturing sites, and other controlled environments. Visitly helps security teams improve operational control while delivering a smoother visitor experience.
See Visitly at your sites in 30 minutes.
SSO and the audit log come with every site.