Evidence, not promises.
You are deciding whether to let AI agents change your systems. That decision should rest on evidence you can check.
This page sets out how Mondoo protects your data, how its agents are governed, and which documents your security review can request.
Independently audited
- SOC 2 Type II
- ISO 27001
- CIS SecureSuite
- GDPR
Security controls audited by independent third parties every year.
Agents act only inside the limits you set
Nothing changes in your environment without a policy you wrote allowing it. Every action can be traced back to that policy.
Scoped
Each agent has one defined job and scope. It cannot act outside it.
Approved
You choose which assets, severities and change windows can be fixed automatically, and which need a person's approval.
Explained
Every fix comes with a plan, an impact statement and a rollback before anything runs.
Verified
Mondoo rescans after each change to confirm the fix worked.
Recorded
What was found, what was fixed, who approved it and when it was verified are all logged as audit evidence.
Your data is encrypted, separated, and kept where you choose
Encrypted at rest and in transit.
AES-256 at rest and TLS 1.3 in transit. Every customer has separate encryption keys.
Separated by customer.
Shared regions keep each customer's data logically separate. Single-tenant deployments get their own database, and self-managed deployments run entirely in your environment, where Mondoo has no access at all.
Held in the region you choose.
The EU region runs on Google Cloud in Frankfurt, operated by Mondoo GmbH in Berlin. The US region is operated by Mondoo Inc. Your data and your backups stay in the region you choose.
Backed up daily.
Backups are taken daily and encrypted. EU region backups are held in Germany.
Access is controlled and logged.
The teams that operate and support the platform hold only the access needed to run it, governed by role-based controls and logged.
Never used to train AI models.
Mondoo uses third-party foundation models for some analysis, such as remediation guidance. Only the data that analysis needs is sent, those providers are covered by our data processing agreement, and your data is never used to train their models.
How we run security at Mondoo
We hold ourselves to the standards we help our customers prove.
Independent audits
SOC 2 Type II and ISO 27001 audits by external auditors every year, plus an internal audit.
Penetration testing
The platform is penetration tested by a third party every year.
People
Every employee completes security awareness training, and engineers complete secure development training.
Vendors
Every third party that handles customer data goes through a documented risk assessment.
Continuity
Business continuity and disaster recovery plans are documented and maintained as part of our ISMS.
Benchmarks
Mondoo is a CIS SecureSuite certified vendor for cloud and Kubernetes security.
Documents you can request
Ask for what your review needs, and we will send it to you directly.
| Document | What it covers |
|---|---|
| SOC 2 Type II report | An independent auditor's opinion on our security controls over the audit period. |
| ISO 27001 certificate | Certification of our information security management system. |
| Penetration test summary | The scope and outcome of our most recent third-party test. |
| Security overview | Our architecture, controls and practices, in one document. |
| Completed security questionnaires | Standard answers, ready to drop into your vendor assessment. |
| Data processing agreement | Available for every deployment model. |
| Subprocessor list | Every subprocessor, including the AI model providers. |
Found a security issue?
If you believe you have found a vulnerability in Mondoo, please tell us before disclosing it publicly. We will acknowledge your report and keep you updated while we investigate.
Common questions
Yes. Mondoo is audited against SOC 2 Type II by an independent auditor every year. You can request the current report from this page.
Yes. Mondoo's information security management system is certified to ISO 27001 and audited externally every year.
Only if you allow it. You decide which assets, severities and change windows agents can fix on their own, and which need a person's approval. Many teams start with workstations and non-production systems and keep production servers and databases on approval.
No. Mondoo sends third-party foundation models only the data a specific analysis needs, the providers are covered by our data processing agreement, and your data is never used to train their models.
In the region you choose: the EU region on Google Cloud in Frankfurt, or the US region. You can also run a single-tenant instance that Mondoo operates for you, or self-manage Mondoo in your own environment.
Bring Mondoo to your security review
Tell us what your review needs. We will send the documents and answer your security team's questions directly.