Security

Security at Sora

Sora ID takes measures to secure our service as well as protect the personal information we collect. Some of the controls we have in place are outlined below.

sora-check-icon

Data Security

We tokenize SPII (Sensitive Personal Identifiable Information) within our systems using VGS, a 3rd party vendor. In addition, we encrypt all client data both at rest and in transit.
sora-check-icon

Application Security

We undergo regular penetration tests, performed by 3rd party application security experts, that evaluate the safety of our product.
sora-check-icon

Infrastructure Security

Sora runs on Google Cloud Platform (GCP). We use many of GCP’s built-in security features, such as Google’s Secret Manager, Key Management System, and Web Application Firewall. Sora is deployed as a containerized service on GCP, meaning that we typically do not need to manually manage servers or compute instances in production.
sora-check-icon

Authentication

We leverage the WebAuthn protocol to create a biometric device-based credential for authentication, if this is supported by a user’s device. When this is not possible, we instead rely on multi-factor authentication, using either phone or email OTPs.
Compliance

We are SOC2, GDPR, and CCPA compliant

We are SOC2, GDPR,
and CCPA compliant

soraid-soc2-type2
soraid-ccpa-compliant
soraid-gdpr

Responsible Disclosure

Data security is one of Sora ID’s top priorities, and we believe that working with skilled security researchers can help us identify weaknesses in our technology. If you believe you’ve found a security vulnerability in our service, please notify us. We will work with you to resolve the issue promptly.

Disclosure Policy

  • If you believe you’ve discovered a potential vulnerability, please let us know by emailing us at security@soraid.com. We will acknowledge your email within five business days.
  • Provide us with a reasonable amount of time to resolve the issue before disclosing it to the public or a third party. We aim to resolve critical issues within five business days of disclosure. Please also provide sufficient information to reproduce the problem.
  • Make a good faith effort to avoid violating privacy, destroying data, or interrupting or degrading the Sora ID service. Please only interact with accounts you own or for which you have explicit permission from the account holder. Please do not take advantage of the vulnerability to download more data than necessary to demonstrate the vulnerability, for example, and please do not delete or modify other people’s data.
  • If you follow the instructions outlined here, we will not take any legal action against you and we will handle your vulnerability report with strict confidentiality. In the public information concerning the problem reported, we will give your name as the discoverer of the issue (unless you desire otherwise).

Exclusions

While researching, we’d like you to refrain from:
  • Distributed Denial of Service (DDoS)
  • Spamming
  • Social engineering or phishing of Sora ID employees
  • Any attacks against Sora ID’s physical property
Thank you for helping to keep Sora ID and our users safe!