DoxxScan was founded by a CEO with offensive-security background. We take "secure by default" seriously because we know how the other side thinks. Below: how we handle data, what we sign, and what we're working toward.
| Framework | Status | Notes |
|---|---|---|
| SOC 2 Type I | In progress (Q3 2026) | Auditor engaged. Preliminary control mapping complete. Type II will follow Q1 2027. |
| HIPAA / BAA | Available | We sign BAAs for healthcare customers. We are a Business Associate, not a Covered Entity. PHI is not stored. |
| GDPR | Compliant | EU data subjects supported. DPA template available. Lead supervisory authority: Ireland. |
| CCPA / CPRA | Compliant | California consumer rights honored. Right-to-delete and right-to-know supported. |
| ISO 27001 | Roadmap | Targeted for 2027 alongside SOC 2 Type II. |
Latest available security review materials shared under NDA during evaluation.
Standard mutual NDA, no edits required for evaluation conversations.
Custom Business Associate Agreement for any healthcare customer. Standard template available; redlines welcomed.
EU-style Data Processing Agreement with SCCs included for cross-border data transfers.
Master Service Agreement with customer-preferred terms for Comprehensive-tier engagements.
Available under NDA during a serious evaluation. Includes: most-recent third-party pen-test report, SOC 2 readiness audit, system architecture overview, data-flow diagrams, incident-response runbook, business-continuity plan, sub-processor list, and security-review questionnaire pre-filled (CAIQ / SIG-Lite).
Honest about where we are. We are a small, focused team. We have not yet completed SOC 2 Type II. We do not have ISO 27001. We're transparent about this because we'd rather you discover it on this page than mid-evaluation. The trade-off: we ship faster, charge less, and the founder is on every customer kickoff call.
Yes. We've responded to standard CAIQ, SIG-Lite, and SIG-Core questionnaires for prior customers. Typical turnaround is 5-7 business days.
Customer notification within 24 hours of confirmed incident. Public post-mortem within 30 days. Standard incident-response runbook available in the vendor pack.
Email support@galaxywarden.com. We honor responsible disclosure with a 90-day window before public disclosure. Bug bounties available for critical findings.
