Kolleno’s Trust Center
Kolleno sits between your ERP, your bank accounts, and your customers. We handle invoices, payment data, and your team’s daily conversations, so security is part of the product, not an add-on.
It shapes how we build, host, and operate. Your data, and your customers’ data, gets the discipline you’d expect from your own finance team: controlled access, clear audit trails, no shortcuts.
⌘K
Compliance
-
SOC 1 Type II
-
SOC 2 Type II
-
ISO-IEC
-
SOC 3 System and Organization Controls
-
European GDPR
Trusted by
-
Rakuten
-
1Password
-
Dealer FX
-
Lansweeper
-
Avalara
-
Miro
-
Drata
-
WSIB
-
Castle Water
Subprocessors
-
Microsoft
https://www.microsoft.com -
HubSpot
https://www.hubspot.com -
Twilio
https://www.twilio.com -
Amazon Web Services
https://aws.amazon.com -
ProfiSea
https://www.profisea.com
Certifications
- SOC 1 Type II Report 2025
- SOC 2 Type II Report 2025
- ISO-IEC 27001-2022 - Certificate 2026
- SOC 3 System and Organization Controls Report 2025
Policies
- ISO27001:2022 Business & Information Security Management System
- Information Security Management System (ISMS) Procedures
- Business Continuity Plan
Controls
- Code Review Process
- Employee Disclosure Process
- Quarterly Vulnerability Scan
- Daily Database Backups
- Encryption at Rest
- Security Policies
- Cloud Data Storage Restricted
- Encryption of Web-Based Admin Access
- Multiple Availability Zones
- Denial of Public SSH
- Firewalls
- Logging/Monitoring
- Acceptable Use Policy
- BCDR Plan
- Code of Conduct
- Databases Monitored & Alarmed
- Hard-Disk Encryption
- Messaging Queues Monitored & Alarmed
Legal terms
Other documentation
- Kolleno Penetration Test Summary 2026
Policies
- Acceptable Use Policy
- Anti-Money Laundering and Financial Crime Policy
- Anti-Slavery and Human Trafficking Policy
- Asset Management Policy
- Backup Policy
- Business Continuity Plan
- Change Management Policy
- Code of Conduct
- Data Classification Policy
- Data Protection Policy
- Data Retention Policy
- Disaster Recovery Plan
- Encryption Policy
- ISO27001:2022 Business & Information Security Management System
- Incident Response Plan
- Information Security Management System (ISMS) Procedures
- Information Security Policy
- Logging and Monitoring Policy
- Network Security Policy
- Password Policy
- Physical Security Policy
- Responsible Disclosure Policy
- Risk Assessment Policy
- Software Development Life Cycle Policy
- System Access Control Policy
- Vendor Management Policy
- Vulnerability Management Policy
App security
- Code Review Process
- Employee Disclosure Process
- Quarterly Vulnerability Scan
- Responsible Disclosure (Bug Bounty)
- Software Development Lifecycle
- Vulnerability Management
- Web Application Firewall
Data security
- Daily Database Backups
- Encryption at Rest
- Security Policies
- SSL/TLS Enforced
- System Access Control Policy
Infrastructure security
- Cloud Data Storage Restricted
- Encryption of Web-Based Admin Access
- Multiple Availability Zones
- Password Policy
- Security Patches Automatically Applied
Network security
- Denial of Public SSH
- Firewalls
- Logging/Monitoring
- Malware Detection Software
- Unique Accounts Used
Organization security
- Acceptable Use Policy
- BCDR Plan
- Code of Conduct
- Disaster Recovery Plan
- Incident Response Plan
- Incident Response Team
- Security Training
Product security
- Databases Monitored & Alarmed
- Hard-Disk Encryption
- Messaging Queues Monitored & Alarmed
- MFA on Accounts
- NoSQL Database Monitored & Alarmed
- Servers Monitored & Alarmed
- Session Lock
- Terms of Service
Step into the new world of order-to-cash
Turn your revenue cycle into a predictable engine with an AI workforce.
