Last updated June 23, 2026
The Sherlock Company has a strong commitment to information security that extends from the security team to senior levels of the organization. This is demonstrated by having implemented the following information security controls:
- All data are stored in the United States using Google Cloud Platform (GCP).
- All data are encrypted at rest using AES-256 and in-transit using at least TLS 1.2.
- All data are backed up daily/weekly/monthly, and The Sherlock Company Disaster Recovery Plan is tested/updated annually.
- Production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.
- The Sherlock Company requires authentication to production datastores to use authorized secure authentication mechanisms, such as unique SSH key.
- The Sherlock Company prohibits confidential or sensitive customer data, by policy, from being used or stored in non-production systems/environments.
- An infrastructure monitoring tool is utilized to monitor systems, infrastructure, and performance and generates alerts when specific predefined thresholds are met.
- The Sherlock Company utilizes a log management tool to identify events that may have a potential impact on The Sherlock Company’s ability to achieve its security objectives.
- The Sherlock Company ensures that user access to in-scope system components is based on job role and function or requires a documented access request form and manager approval prior to access being provisioned.
- The Sherlock Company has a mobile device management (MDM) system in place to centrally manage mobile devices supporting the service.
- SOC II, Type 2 compliant since 2023. Read more here