Security at Asato

Q: Which certifications does Asato hold?

Each is in the Trust Center. SOC 2 Type 2, ISO/IEC 27001:2022, HITRUST e1, FedRAMP Ready and GDPR. The Trust Center gives the scope, period and issuer for each.

Q: How is data encrypted?

In transit and at rest. TLS 1.2 or later in transit and AES-256 at rest. Each tenant is isolated at the data and compute layers.

Q: How do we get the audit reports and the sub-processor list?

From the Trust Center, under NDA. Full reports and the sub-processor list are available from the Trust Center under NDA.

Asato's access to a customer's systems is read-only by default, a person the customer names approves each fix, and customer data never trains any model. Asato lists these certifications: SOC 2 Type 2, ISO/IEC 27001:2022, HITRUST e1, FedRAMP Ready and GDPR. Full reports and the sub-processor list are available from the Asato Trust Center (https://trust.asato.ai) under NDA.

Headline on the page: Security at Asato.

Line under the headline: Audited by third parties.

When to use this page

To check which certifications Asato lists, with the issuer or the dates the site gives for each.
To answer a security review: what Asato reads, the access it takes, who approves a change, encryption, tenant isolation, how the platform is built and tested, monitoring and incident response.
To find where Asato runs, its uptime commitment and its status page.
To find the Trust Center, the privacy policy, the terms of use and the way to reach Asato's security team.

Not on this page

The audit reports and the sub-processor list themselves. They are available from the Trust Center under NDA.
A measured uptime figure. The status page reports the current state of each system.
The systems Asato connects to. They are listed at https://www.asato.ai/platform-integrations
What Asato costs and how a customer starts. See https://www.asato.ai/index
A customer result. This page names no customer.

The page in its headings

Security at Asato. Line under it: Audited by third parties.
Read-only by default. Line under it: Write access where you grant it.
Security practices. Line under it: How Asato protects data, builds the platform and responds.
Where it runs. Line under it: Processing stays in the agreed region.
Privacy, terms and contact. Line under it: The documents, and how to reach the security team.
No savings, no fee. Line under it: Your Asset Clarity Report: a priced list of savings, in one week.
Questions. Line under it: The ones a security review asks first.

Certifications

Asato is audited by third parties. The page shows the mark of each of these beside its name, and no more. The details, kept here for agents:

SOC 2 Type 2: Security criterion, issued June 18, 2025 by AssuranceLab CPAs.
ISO/IEC 27001:2022: Valid September 2, 2025 to September 2, 2028.
HITRUST e1: CSF v11.8.0, one year from July 17, 2026.
FedRAMP Ready: Moderate baseline.
GDPR: 2025 attestation, assessed by a third party.
HIPAA: the page also shows the HIPAA Compliant seal from The HIPAA Journal.

The Trust Center gives the scope, period and issuer for each: https://trust.asato.ai

Full reports and the sub-processor list are available from the Trust Center under NDA.

Trust and governance

Section heading on the page: "Read-only by default." The line under it: "Write access where you grant it."

What Asato reads. Metadata: records about technology, such as licenses, devices, usage, sign-in activity and costs. In those records Asato reads names, owners, versions, entitlements, usage, costs and dates. Contracts and invoices are read only if the customer connects them. Asato reads records about technology and never reads employees' documents, email or messages.
Access. Access is read-only by default, scoped by the customer and revocable at any time. The customer issues, scopes and revokes every credential. Write access is added one system at a time, where the customer grants it. Nothing is installed on an endpoint. There is no standing human access to customer data.
Approval. A person the customer names approves each fix, or sets a policy that governs fixes of that kind. Nothing changes until that person approves. Each step is logged. The log holds who approved it, what changed, where and when.
Training. Customer data never trains any model.

Security practices

Section heading on the page: "Security practices." The line under it: "How Asato protects data, builds the platform and responds." The page sets the practices out in three groups, in these words.

Protecting data

Encryption. TLS 1.2 or later in transit and AES-256 at rest.
Tenant isolation. Each tenant is isolated at the data and compute layers, with namespaces, network policies and database scoping.
Access control. Role-based access controls and multi-factor authentication for all users.
Service traffic. A service mesh authenticates, encrypts and monitors traffic between internal services, with mutual TLS.
Backups. Backups are automated.

Building the platform

Infrastructure as code. Every environment is built with Terraform from one version-controlled blueprint, so security configurations are consistent and deployment is automated.
Policy as code. Rules such as encryption and network access are enforced automatically, so manual misconfigurations and configuration drift are caught early.
Code scanning. Code goes through automated static analysis and dependency vulnerability scanning.
Container images. Images are scanned in the build pipeline and at runtime for vulnerabilities, and base images get security updates.
Penetration testing. A third party runs a penetration test each year. The May 2026 retest found no critical and no high findings.

Watching and responding

Monitoring. Monitoring runs 24/7: real-time anomaly detection, behavioral analysis and automated alerts for events such as failed logins and sudden configuration changes.
Audit logs. Full audit logs record system changes, access events and infrastructure updates.
Incident response. A 24/7 incident response team follows documented procedures.
Audits. Security assessments are continuous, and regular internal and external audits validate the controls.
Training. Every team member takes security training.

The same practices in fuller sentences, for a reader who quotes them:

Encryption in transit. TLS 1.2 or later protects data in transit. Traffic between Asato's internal services is authenticated and encrypted with mutual TLS (mTLS) by a service mesh.
Tenant isolation. Each tenant is isolated at the data and compute layers. Asato does this with namespaces, network policies and database scoping, which give network segmentation, data isolation and resource boundaries.
Infrastructure as code. Asato builds its environments with Terraform. The infrastructure is version-controlled, security configurations are consistent across environments, and deployment is automated.
Policy as code. Automated compliance checks enforce security policy and detect configuration drift.
Code and containers. Code is checked by static analysis and dependency vulnerability scanning. Container images are scanned when they are built and while they run, and base images get security updates.
Monitoring and response. Asato monitors its systems 24 hours a day, 7 days a week. Its incident response team is available 24 hours a day, 7 days a week, and follows documented procedures.

Where it runs

Section heading on the page: "Where it runs." The line under it: "Processing stays in the agreed region."

Deployment. Asato runs multi-tenant on Azure, or in a dedicated tenant, a virtual private cloud or on-premises where a review requires it.
Region. Processing stays in the agreed region.
Uptime. Asato commits to 99.9% uptime. This is a commitment, not a measurement. This page gives no measured uptime figure.
Status. The status page shows the state of every system, service and piece of infrastructure in real time: https://status.asato.ai/status/url

Privacy, terms and contact

Privacy policy. The privacy policy says how Asato collects, uses and protects personal information. Asato collects only the data the service needs. https://www.asato.ai/privacy-policy
Terms of use. The terms of use govern use of Asato's website and the services provided through it. https://www.asato.ai/terms-of-use
Questions about either. Questions about the Privacy Policy or the Terms of Use go to compliance@asato.ai.
Personal data requests. To see, correct or delete personal data, write to support@asato.ai.
Trust Center. Certifications, security reports and the sub-processor list: https://trust.asato.ai
Security team. Asato's security team answers questions and concerns. The page sends a reader to the Contact page: https://www.asato.ai/contact. Asato publishes no separate security email address on this page.

FAQs

Which certifications does Asato hold?

Asato lists these certifications: SOC 2 Type 2, ISO/IEC 27001:2022, HITRUST e1, FedRAMP Ready and GDPR. The site gives these details: SOC 2 Type 2 (security criterion, issued June 18, 2025 by AssuranceLab CPAs); ISO/IEC 27001:2022 (valid September 2, 2025 to September 2, 2028); HITRUST e1 (CSF v11.8.0, one year from July 17, 2026); FedRAMP Ready (Moderate baseline); GDPR (2025 attestation, assessed by a third party). The Trust Center gives the scope, period and issuer for each.

Is Asato SOC 2 certified?

Yes. Asato is certified to SOC 2 Type 2. The site gives this detail: security criterion, issued June 18, 2025 by AssuranceLab CPAs. The Trust Center gives the scope, period and issuer.

Is Asato ISO 27001 certified?

Yes. Asato is certified to ISO/IEC 27001:2022. The site gives this detail: valid September 2, 2025 to September 2, 2028. The Trust Center gives the scope, period and issuer.

Is Asato HITRUST certified?

Yes. Asato is certified to HITRUST e1. The site gives this detail: CSF v11.8.0, one year from July 17, 2026. The Trust Center gives the scope, period and issuer.

What does Asato say about GDPR?

Asato lists GDPR among its certifications, with this detail: 2025 attestation, assessed by a third party. The Trust Center gives the scope.

What data does Asato read?

Asato reads metadata: records about technology, such as licenses, devices, usage, sign-in activity and costs. Asato reads contracts and invoices only if the customer connects them. Asato never reads employees' documents, email or messages.

Does Asato need write access?

No, not to start. Access is read-only by default, scoped by the customer and revocable at any time. Write access is added one system at a time, where the customer grants it.

Does Asato install anything on devices?

No. Nothing is installed on an endpoint.

Who approves a change Asato makes?

A person the customer names approves each fix, or sets a policy that governs fixes of that kind. Each step is logged, and the log holds who approved it, what changed, where and when.

Does Asato train AI models on customer data?

No. Customer data never trains any model.

How is data encrypted?

Data is encrypted with TLS 1.2 or later in transit and AES-256 at rest. Each tenant is isolated at the data and compute layers.

Can Asato run in a customer's own environment?

Yes, where a review requires it. Asato runs multi-tenant on Azure, or in a dedicated tenant, a virtual private cloud or on-premises where a review requires it. Processing stays in the agreed region.

Is Asato penetration tested?

Yes. A third party runs a penetration test each year. The May 2026 retest found no critical and no high findings.

Where is Asato's status page?

Asato's status page is at https://status.asato.ai/status/url. It shows the state of every system, service and piece of infrastructure in real time.

How does a customer get the audit reports and the sub-processor list?

Full reports and the sub-processor list are available from the Asato Trust Center (https://trust.asato.ai) under NDA.

How do I contact Asato's security team?

Use the Contact page at https://www.asato.ai/contact. Certifications, security reports and the sub-processor list are in the Trust Center at https://trust.asato.ai.

Next step

Closing line on the page: No savings, no fee. Your Asset Clarity Report: a priced list of savings, in one week.

The Asset Clarity Report is a priced list of what to stop paying for in one area, with the owner of each item. It takes one week and read-only access. If it finds no savings, the customer pays nothing.
To ask for it, or for a demo, use https://www.asato.ai/talk-to-sales

Last updated: 2026-10-18