Trust & Security
Security & Compliance
Tonion is built for enterprises that cannot afford to compromise. Here is exactly what we do to protect your data and meet your compliance requirements.
AES-256 encryption at rest
TLS 1.3 in transit
Zero trust architecture
Tonion is actively pursuing industry-standard certifications. Below is the live status of each programme, including the specific controls and checklist items covered. Request access to audit reports and compliance documents via the individual cards.
SOC 2 Type II
Annual audit by an independent CPA firm covering Security, Availability, and Confidentiality trust service criteria.
In Progress
10 of 11 controls
91%
CC1 - Control environment & organisational structure
CC2 - Communication and information
CC3 - Risk assessment process
CC4 - Monitoring of controls
CC5 - Control activities and policies
CC6 - Logical and physical access controls
CC7 - System operations and incident detection
CC8 - Change management
CC9 - Risk mitigation and vendor management
A1 - Availability commitments and SLAs
C1 - Confidentiality of designated information
ISO 27001
International standard for information security management systems (ISMS). Certification via accredited third-party auditor.
Planned
3 of 9 controls
33%
Information security policy and objectives
Risk assessment and treatment plan
Asset management and classification
Access control and user management
Cryptography and key management
Physical and environmental security
Supplier relationships and third-party risk
Information security incident management
Business continuity and DR planning
GDPR
EU General Data Protection Regulation compliance for customers processing personal data of EU residents.
Compliant
8 of 8 controls
100%
Lawful basis for all data processing activities
Data subject rights (access, erasure, portability)
Privacy by design and by default
Data Processing Agreement (DPA) available
Breach notification within 72 hours
Records of processing activities (Article 30)
Standard contractual clauses for data transfers
Data Protection Impact Assessments (DPIA)
India DPDP Act 2023
Digital Personal Data Protection Act - India's primary data protection legislation governing personal data processing.
Compliant
7 of 7 controls
100%
Consent management and withdrawal mechanism
Data fiduciary obligations and notice requirements
Data principal rights (access, correction, erasure)
Grievance redressal mechanism
Cross-border data transfer controls
Significant data fiduciary obligations (if applicable)
Data breach notification to DPBI
HIPAA
US Health Insurance Portability and Accountability Act. Required when customers process protected health information (PHI).
Planned
1 of 7 controls
14%
Administrative safeguards and workforce training
Physical safeguards for systems handling PHI
Technical safeguards - access and audit controls
Business Associate Agreement (BAA) available
PHI encryption at rest and in transit
Breach notification procedures (60-day rule)
Minimum necessary standard for data access
PCI DSS
Payment Card Industry Data Security Standard. Required if customer workflows interact with cardholder data.
Planned
2 of 7 controls
29%
Cardholder data environment (CDE) scoping
Network security controls and firewall rules
Strong access control and least-privilege
Regular vulnerability scanning and pen testing
Encryption of cardholder data in transit
Logging and monitoring of all CDE access
Information security policy and procedures
Need security documentation for your procurement review?
Request our security whitepaper, audit reports, or a DPA - we respond within 2 business days.