Genkatsu processes 2.7B sales interactions per quarter for 2,400+ revenue teams across 38 countries. The platform holds three active enterprise certifications, runs on infrastructure trusted by three of the Fortune 100, and ships with a 99.98% uptime guarantee. Everything below is the evidence behind those numbers — written for security engineers, CISOs, and procurement evaluators who don't accept vendor hand-waves.
Each report covers the controls a procurement checklist actually asks about: access management, change control, encryption, vendor risk, incident response, and business continuity. Request the full reports under NDA at the bottom of this page.
AICPA Trust Services Criteria
No exceptions noted in the most recent report.
Information Security Management System
Renewed surveillance audit scheduled 2026-Q1.
Health Insurance Portability and Accountability Act
Not certified for GDPR — by design. See data residency below for EU controls.
The control map below is the same one our security team walks enterprise auditors through. We hold ourselves to the standards a CISO would write if they were building the platform — because several of our engineers came from environments where that was their day job.
Every Genkatsu tenant is pinned to a primary processing region at provisioning. Data never leaves that region except for explicit, audited cross-region replication you can turn off. Latency numbers below are p50 measured from a sample of 2,400+ production tenants over the last 30 days.
AWS us-east-1 · Ashburn, VA
AWS us-west-2 · Boardman, OR
AWS eu-central-1 · Frankfurt, DE
AWS ap-southeast-2 · Sydney, AU
Region pinning is enforced at the application and network layers. Cross-region replication requires an explicit tenant setting and is logged. Customers in regulated industries (financial services, healthcare, EU public sector) typically pin to a single region with replication disabled.
This is the standard DPA subprocessor schedule. Each vendor is listed with the function it performs, the data scope it receives, and its own security posture. We notify customers at least 30 days before adding a new subprocessor, and the change log is append-only.
Primary cloud infrastructure · compute, storage, KMS, networking across all four regions.
Edge proxy, WAF, DDoS protection, and TLS termination at the public perimeter.
Foundation model provider for coaching generation, summarization, and pattern extraction.
Application performance monitoring, log aggregation, and the audit-log forwarder.
Analytics warehouse for aggregated, anonymized coaching-performance metrics.
Identity, SSO, and SCIM provisioning for Genkatsu end users.
Full DPA and subprocessor change notification workflow available on request. Customers may object to a new subprocessor within 30 days of notification; unresolved objections allow contract termination without penalty.
If you're a qualified evaluator — security engineer, CISO, procurement lead, GRC analyst — we hand over the full SOC 2 Type II report, the ISO 27001 certificate and statement of applicability, the HIPAA attestation letter, and the latest penetration-test executive summary within one business day.
One-way or mutual — your call. We counter-sign within 24 hours via DocuSign.
SOC 2, ISO 27001, HIPAA attestation, and pen-test summary delivered to your verified work email.
A sales engineer who can actually read the report walks you through the architecture diagram and answers what the documents don't.
Not ready to sign an NDA? Book a demo with a sales engineer who has read every line of the SOC 2 report and can answer live.
