SOC 2 Type II
Our security controls are independently audited under SOC 2 Type II. Qualified customers can request the full report under a nondisclosure agreement.
Trust CenterSecurity and compliance
How Ad Astra protects your data
Hospitals, government agencies, courts, and enterprises trust Ad Astra with sensitive conversations and documents every day. This page explains the certifications we hold, the security practices behind AdAstraConnect, how we handle your data, and how to request our full security documentation.
SOC 2 Type II auditedISO 9001 certifiedHIPAA-aligned
Security postureAudited
Certifications
SOC 2 Type IIReport available under NDA
AuditedISO 9001:2015Quality management, DQS
CertifiedHIPAA-alignedBusiness Associate Agreements
BAA readyPlatform controls
AES-256
TLS
SSO
Role-based accessFull audit logsDR and BCP
SOC 2
Type II, independently audited
ISO 9001
Certified quality management
AES-256
Encryption at rest
24/7/365
Staffed operations
Certifications
Independently audited, every year
Our certifications are reviewed by independent auditors, so you can rely on more than our word.
ISO 9001:2015
Our quality management system is certified to ISO 9001:2015 by DQS.
ISO 17100 and ISO 18587
Our translation workflows follow ISO 17100, and machine translation post-editing follows ISO 18587.
HIPAA
HIPAA-aligned workflows for protected health information, with ongoing third-party HIPAA audits. We sign Business Associate Agreements (BAAs).
Privacy regulations
Our practices are aligned with GDPR, UK GDPR, CPRA, and PIPEDA.
Government
GSA Multiple Award Schedule contract holder, SAM-registered, with CJIS-aligned practices for criminal justice work.
Security
Security built into AdAstraConnect
AdAstraConnect is the platform behind our interpretation, translation, and call center services. These controls apply to every account.
Encryption
Data is encrypted with AES-256 at rest and with TLS in transit.
Access control
Single sign-on (SSO) and role-based permissions, so each user sees only what their role requires.
Audit trails
Activity in AdAstraConnect is recorded in full audit logs that your administrators can review.
Vetted linguists
Every linguist is vetted before their first assignment and is bound by confidentiality obligations.
Business continuity
Documented disaster recovery and business continuity plans, a primary operations facility in Silver Spring, Maryland, staffed 24/7/365, and a second facility in Brossard, Quebec, for continuity.
One managed platform
Scheduling, sessions, documents, and reporting run in one system, so your data is not scattered across separate tools.
Data handling
How we handle your data
We collect only what we need to deliver your services, and we handle it according to your contract.
| Topic | Our practice |
|---|---|
| What we collect | Scheduling and session details, documents you send for translation, recordings when you turn recording on, and the billing and contact details needed to run your account. |
| Where it is stored | AdAstraConnect runs on secure cloud infrastructure, with your data encrypted at rest and in transit and access limited by role. |
| Recordings and transcripts | Call recording is optional, and the retention window is set in your contract to match your records policy. |
| Retention and deletion | We keep data for as long as your contract requires. When a contract ends, or when you ask, we delete it according to the terms we agreed with you. |
| Your data is never sold | We do not sell your data. |
Subprocessors
The partners who help us deliver
We work with a small number of carefully selected service providers to host, operate, and support our services. Each is reviewed before use and bound by contractual data protection terms. Our current subprocessor list is available on request.
Report a security concern
If you believe you have found a security vulnerability or suspect misuse of an Ad Astra service, email info@ad-astrainc.com with “Security” in the subject line. We review every report and will keep you updated while we investigate.
FAQ
Trust and security, answered
Yes. Ad Astra's controls are independently audited under SOC 2 Type II, which tests how those controls operate over a period of time, not just on a single day. Qualified customers and prospects can request the full SOC 2 Type II report under a nondisclosure agreement through the form on this page.
Yes. Our workflows for protected health information are HIPAA-aligned, and we undergo ongoing third-party HIPAA audits. We sign Business Associate Agreements with healthcare clients as a standard part of onboarding. Request a copy of our BAA through the form on this page.
Data is encrypted with AES-256 at rest and with TLS in transit. Access to AdAstraConnect is controlled through single sign-on and role-based permissions, so each user sees only what their role requires, and activity is recorded in full audit logs.
Yes. We work with a small number of carefully selected service providers to host, operate, and support our services. Each is reviewed before use and bound by contractual data protection terms. Our current subprocessor list is available on request through the form on this page.
Recordings and transcripts are kept according to the retention window in your contract, and you can set that window to match your own records policy. When a contract ends, or when you request it, we delete your data according to the terms we agreed with you.
Email info@ad-astrainc.com with "Security" in the subject line, a description of the issue, and any steps to reproduce it. We review every report, confirm receipt, and keep you updated while we investigate. Please do not access, change, or share data that does not belong to you while testing.
Security documentation
Request security documentation
Tell us what your security or procurement team needs, and we will send it or set up a call.
- SOC 2 Type II report under a nondisclosure agreement
- Business Associate Agreements for healthcare clients
- Help completing your security questionnaire
Request security documentation
Thank you.
Our team will follow up with next steps for your request.