Security and compliance
This page is designed for IT, security, and procurement teams evaluating the Peopletree Group platform. It covers cloud architecture, encryption standards, access controls, compliance certifications, and integration capabilities.
Certifications and audits
Peopletree Group undergoes independent third-party audits on an annual basis. Full reports are available to prospective customers and IT teams under NDA.
SOC 2 Type II
Security and Confidentiality -- independently audited
Audited by Laika Compliance LLC under AICPA Trust Services Criteria. Controls for security and confidentiality were suitably designed and operated effectively throughout the audit period. No significant incidents recorded.
Annual Penetration Testing
Grey-box -- all findings remediated
Annual grey-box penetration test conducted by an independent security firm covering web applications and APIs. All identified findings are remediated and validated before the report is closed.
GDPR / POPIA
Data processing agreements available
Data processing agreements available for all clients. Customer controls data classification and retention policies.
Azure Security Centre
Continuous threat detection active
Microsoft Defender for Cloud provides continuous vulnerability scanning and threat detection across the entire platform infrastructure.
Platform architecture
The Peopletree platform runs entirely on Microsoft Azure in the Germany West Central region. All components are deployed within a private virtual network with no public-facing management ports.
Encryption and data handling
Access management
Security procedures
Change and vulnerability management
- All changes reviewed, tested, and approved before deployment
- Continuous vulnerability scanning -- critical patches within 24 hours
- Microsoft Defender for Cloud -- real-time threat detection
Incident response
- Documented plan: identification, containment, remediation, and communication
- Notification to affected parties within agreed windows
- 90-day+ log retention via Azure Monitor and Log Analytics
Business continuity
- Documented BC/DR plan with defined resumption steps
- Geo-redundant storage with point-in-time restore
- Redundant infrastructure with load balancing on Azure
Personnel and vendor security
- Security awareness training and background checks for all employees
- Role-based access provisioning -- revoked within 24 hours of termination
- All vendors assessed for security compliance before onboarding