Security at Automatum.
Your marketplace listings, private offers, and co-sell deals are commercial data. This page shows how we protect that data, which checks we passed, and which documents you can get for your security review.
Checked by other parties.
Each item below shows its status today. We give the reports to customers and prospects under a non-disclosure agreement.
- CompleteAWS Qualified SoftwareAutomatum passed the AWS Foundational Technical Review. AWS examined our security, reliability, and operations against its best practices.
- CompleteSOC 2An independent auditor examined our controls. The report is available under a non-disclosure agreement.
- CompletePenetration testAn external security firm tested the product in the last 12 months. A summary is available under a non-disclosure agreement.
- SupportedGDPRWe process personal data only on your instructions. We sign a data processing addendum with each customer that needs one.
- AvailableSingle sign-onYour team signs in with your identity provider. Roles control what each user can see and change.
- On the roadmapISO 27001We do not hold this certificate today. Ask us for the current plan.
Built only on AWS.
The Automatum product runs only on Amazon Web Services. It uses serverless AWS services: Amazon API Gateway, AWS Lambda, Amazon Cognito, Amazon DynamoDB, Amazon SQS, Amazon S3, and Amazon Bedrock. We operate no servers of our own.
AWS holds these attestations for the data centres, hardware, and network below our product. They cover the AWS layer. They do not replace our own SOC 2 report.
- SOC 1
- SOC 2
- SOC 3
- ISO 27001
- ISO 27017
- ISO 27018
- PCI DSS Level 1
Controls, and where each one applies.
Each control below is in effect today. The last column shows the plan or the condition that the control applies to.
| Area | Control | Applies to |
|---|---|---|
| Data location | All product data is stored and processed on Amazon Web Services. We use no other cloud for the product. | All plans |
| Tenant isolation | Each record belongs to one organisation. Each event and each background job carries the organisation ID through all its steps. | All plans |
| Authentication | Users sign in through Amazon Cognito. The API checks a signed token on each authenticated request. | All plans |
| Single sign-on | Your team signs in with your identity provider. | Enterprise plan |
| Authorisation | Role-based access. A role sets what a user can see and change. | All plans |
| API access | Your systems call the Automatum API with OAuth 2.0 machine-to-machine tokens. | All plans |
| Access to your AWS account | You create one IAM role in your own account from our CloudFormation template. Automatum assumes the role with an external ID that is unique to your organisation. You can delete the role at any time. | When you connect AWS |
| Your marketplace data feeds | AWS delivers the feeds to an S3 bucket in your account, encrypted with a KMS key in your account. Automatum reads the bucket through your role and checks the bucket owner before each read. | When you turn on analytics |
| No inbound connection | Marketplace events go to a queue in your AWS account. Automatum reads the queue. We open no connection into your network. | When you connect AWS |
| Webhook integrity | When you set a webhook secret, each webhook has an HMAC-SHA256 signature in the X-Automatum-Signature header. | All plans |
| Report downloads | A report opens through a link that stops working after a short time. | All plans |
| Encryption | TLS for data in transit. Encryption at rest for stored data. | All plans |
| Failure handling | Each queue has a dead-letter queue. An alarm tells our engineers when a message fails. Scheduled jobs find and correct private offers and usage records that did not complete. | All plans |
| AI controls | The copilot and the Listing Agent run on Amazon Bedrock. Amazon Bedrock Guardrails check each copilot message. | All plans |
| Self-hosted integrations | The integrations run in your own cloud account. | Self-hosted plan |
Who is responsible for what.
Automatum is a processor between your systems and the cloud marketplaces. This table shows where each responsibility is.
| Area | Automatum | You |
|---|---|---|
| Data centres, hardware, and network | AWS operates and secures them. We select the AWS services and configure them. | None. |
| The Automatum product | We operate, monitor, and correct the service. We manage encryption. | None. |
| Who can use your organisation | We make sure that each user signs in, and we apply the roles. | You invite users, give them roles, and remove users who leave. |
| The IAM role in your AWS account | We use the role only for the marketplace operations of your organisation, with your external ID. | You create the role, examine its use in AWS CloudTrail, and delete it when you stop. |
| CRM and Slack connections | We keep the tokens and use them only for your organisation. | You approve each connection and remove it when you stop. |
| API tokens and webhook secrets | We issue and check the tokens. We sign the webhooks. | You keep them secret, replace them, and check each webhook signature. |
| The data that you send | We process it under the terms and the data processing addendum. | You decide which data to send. |
Where your data goes.
Automatum sits between your team, your AWS account, your CRM, and the cloud marketplaces. Each connection is encrypted and belongs to one organisation.
| Data | Where it comes from | Where it goes |
|---|---|---|
| Marketplace events | AWS Marketplace | A queue in your AWS account, then Automatum |
| Listings and private offers | Your team, in the web app or in HubSpot | Automatum, then AWS Marketplace through the role in your account |
| Usage records | Your product, through the API | Automatum, then AWS Marketplace metering |
| Marketplace data feeds | AWS Marketplace | An S3 bucket in your account, then Automatum reports |
| Co-sell opportunities | AWS Partner Central, Microsoft Partner Center, or your CRM | Automatum and your CRM |
| Notifications | Automatum | Email, Slack, HubSpot, and your webhooks |
The control library.
Items with no mark are facts about the product. Our SOC 2 report describes the items with the SOC 2 mark. Request the report for the detail.
Access control
- Sign-in through Amazon Cognito
- Single sign-on with your identity provider
- Role-based access for each user
- OAuth 2.0 tokens for API access
- Internal single sign-on SOC 2
- Least privilege SOC 2
- Password security SOC 2
- Separation of duties SOC 2
Product security
- Team management with roles
- Signed webhooks (HMAC-SHA256)
- CRM and Slack connections through OAuth
- Audit logging SOC 2
Data security
- Encryption in transit with TLS
- Encryption at rest
- Data feeds stay in your bucket, with your KMS key
- Report links that expire
- Data retention and erasure SOC 2
- Backups SOC 2
Application security
- Penetration test by an external firm
- AWS Foundational Technical Review passed
- A public vulnerability disclosure policy
- Software development lifecycle SOC 2
- Vulnerability and patch management SOC 2
Infrastructure
- Amazon Web Services only
- Serverless AWS services, with no servers that we manage
- A production environment that is separate from development
- Dead-letter queues and alarms on each job
- Business continuity and disaster recovery SOC 2
Network security
- The API is behind Amazon API Gateway
- No inbound connection into your network
- Firewall and network monitoring SOC 2
AI
- Amazon Bedrock for the copilot and the Listing Agent
- Amazon Bedrock Guardrails on copilot messages
- AWS states that Amazon Bedrock does not use your content to train its base models
Data privacy
- A privacy policy
- A public list of subprocessors
- A data processing addendum
- Breach notification procedure SOC 2
Corporate and endpoint security
- Staff security training SOC 2
- Staff screening and offboarding SOC 2
- Asset management SOC 2
- Incident response SOC 2
- Device protection and disk encryption SOC 2
Documents for your review.
Public documents open from this page. Locked documents are confidential. Request them with your work email address.
| Document | What it covers | Access |
|---|---|---|
| Compliance | ||
| SOC 2 report | The auditor’s report on our controls | |
| Penetration test summary | The scope and the result of the most recent external test | |
| AWS Foundational Technical Review | The AWS review behind the AWS Qualified Software status | |
| Reports | ||
| Data flow overview | How data moves between you, Automatum, and the marketplaces | Public |
| Security whitepaper | Architecture, controls, and operations in one document | In preparation |
| Self-assessments | ||
| CAIQ Lite | The Cloud Security Alliance questionnaire, with our answers | In preparation |
| SIG Lite | The Shared Assessments questionnaire, with our answers | In preparation |
| Policies | ||
| Security policies | The policies that our SOC 2 audit examined, such as access control, incident response, and vulnerability management | |
| Legal | ||
| Privacy policy | The personal data that we collect and how we use it | Public |
| Terms and conditions | The terms for this site and the product | Public |
| Subprocessors | The other companies that process data for us | Public |
| Vulnerability disclosure policy | How to report a security problem to us | Public |
| Data processing addendum | The GDPR terms between you (controller) and Automatum (processor) | |
| Service level agreement | Availability and support commitments | In preparation |
| Cyber insurance certificate | Proof of our cyber insurance cover | In preparation |
How access works.
- Step 1
Send the request.
Select the documents and give your work email address, your name, and your company.
- Step 2
We check the request.
A person on our team confirms your address and your company. We send a non-disclosure agreement if a document needs one.
- Step 3
You get the documents.
We send them to your work address. We do not put confidential documents on this site.
Report a security problem.
If you find a vulnerability in an Automatum system, tell us at hello@automatum.io.
- We confirm your report in 5 business days
- We tell you when the problem is corrected
- No legal action against good-faith reports
Questions from security teams.
Is your question not here? Write to hello@automatum.io.
Does Automatum have a SOC 2 report?
Yes. An independent auditor examined our controls.
Is Automatum certified to ISO 27001?
No. We do not hold this certificate today. AWS holds ISO 27001 for the infrastructure below our product.
Does Automatum comply with GDPR?
We process personal data only on your instructions, we publish our subprocessors, and we sign a data processing addendum with each customer that needs one.
How is my data encrypted?
TLS protects data in transit. Stored data is encrypted at rest. Your marketplace data feeds stay in a bucket in your own AWS account, with a KMS key in your account.
Where is my data processed and stored?
On Amazon Web Services only. Ask us for the AWS regions that apply to your account.
What access does Automatum have to my AWS account?
One IAM role that you create from our CloudFormation template. Automatum assumes the role with an external ID that is unique to your organisation. The role gives access to AWS Marketplace and, if you turn it on, AWS Partner Central. You can see each use in AWS CloudTrail, and you can delete the role at any time.
Is my data separate from the data of other customers?
Yes. Each record belongs to one organisation, and each event and background job carries the organisation ID.
Does Automatum use my data to train AI models?
No. The AI features use Amazon Bedrock. AWS states that Amazon Bedrock does not use your content to train its base models.
How do I control who has access?
Give each user a role. On the Enterprise plan, connect your identity provider for single sign-on.
How do I report a security problem?
Follow the vulnerability disclosure policy. Send the report to hello@automatum.io.
How do I get the security documents?
Select the documents in the library on this page and send the request from your work address. We check each request by hand.
Let’s map your cloud sales journey.
Tell us where you are today. We’ll look at your listing, program readiness, co-sell process and CRM setup, then work out the next steps with you.
What we’ll work through
- Your listing and program readiness
- Your co-sell process and CRM setup
- Scope, timing and pricing
