Table of Contents

Security & Compliance

Dawn Rorick Updated by Dawn Rorick

Read Time: 3 mins

Sonar's Security Strategies

Security is at the core of how Sonar operates. We give ISPs a platform built to protect their data, with industry-standard safeguards and continuous monitoring around the clock.

This article covers how Sonar protects your data and what we expect from you as a security partner. For audit reports, certifications, and compliance documentation, visit the Sonar Trust Center.

Compliance and Certifications

Sonar holds a SOC 2 Type 2 certification, independently audited and unqualified, confirming our security controls were designed appropriately and operated effectively across real workflows throughout the review period.

Our cloud infrastructure also meets stringent international and industry-specific standards, including SOC 1, SOC 2, GDPR, HIPAA, FedRAMP, and CSA STAR, each verified through independent third-party audits.

To request current certifications and reports, visit the Sonar Trust Center.

Security in the Cloud

Sonar hosts your data with established cloud providers in regional, mission-critical data centers designed with multiple layers of redundancy and protection:

  • Fully redundant subsystems.
  • Compartmentalized security zones.
  • Multi-factor and biometric authentication options.
  • 24/7 surveillance by dedicated security personnel.

Data Encryption and Secure Connections

Sonar protects the confidentiality and integrity of data in transit and at rest using encryption standards appropriate to data sensitivity and risk.

  • In Transit: Data is encrypted using TLS 1.2 or higher.
  • At Rest: Data is encrypted with AES 256-bit encryption.
  • Geographic Residency: Flexible data residency options are available.
  • Tokenization: Sensitive payment data is tokenized for added security.

Network Security

Sonar manages and protects its network infrastructure across cloud and application layers, with controls implemented to restrict unauthorized access, segment systems by risk, and protect communications between trusted and untrusted networks.

  • Network security groups (NSGs) controlling inbound and outbound traffic at the network and transport layers across Azure VNets.
  • Network segmentation applied based on risk, data sensitivity, and system architecture.
  • Zero Trust access controls via Cloudflare, including identity-aware application access, traffic policy enforcement, and data loss prevention.
  • Identity threat detection and response (ITDR) monitoring for suspicious access patterns and credential-based threats.
  • Centralized logging and monitoring for security events across the platform.
  • Network configuration changes managed through approved change management procedures.

Access Controls and Data Governance

Sonar's platform uses granular, role-based permissions so you control who can do what:

  • User Roles: Group permissions define which actions users can perform.
  • Permissions: Permissions are customizable within each module.
  • Modules: Functional areas of the platform are managed independently.

Our Shared Security Partnership

Security is a shared responsibility. Sonar connects to your technology environment, so keeping your instance secure depends on both of us.

Your responsibilities:

  • Secure your database access (for example, IP whitelisting, TLS encryption, SSH tunneling).
  • Apply restrictive user permissions within your Sonar instance.

Sonar's responsibilities:

  • Maintain code quality and secure development practices.
  • Run continuous monitoring and vulnerability scanning.

Corporate and Product Security

Security is embedded at every layer of our organization and product development lifecycle.

Corporate Security

  • A dedicated Information Security team, led by the Information Security Manager.
  • Security policies reviewed and approved by leadership.
  • Background checks for all employees.
  • Regular security training for all staff.
  • 24/7 monitoring, with Security and DevOps teams on-call for immediate response.
  • A comprehensive, regularly tested incident response plan.

Product Security

  • Peer-reviewed code and a secure software development lifecycle.
  • Automated testing for injection flaws, input validation, and CSRF token usage.
  • Regular penetration testing to identify and mitigate vulnerabilities.
  • Multi-layer authentication for back-end system access.
  • Logging and monitoring for all access and anomalies.

How Sonar Uses Data and Monitors Systems

Sonar uses first- and third-party tools to improve the platform and support your use of it:

  • Usage Analytics: Helps us improve the platform based on how it's used.
  • Configuration Backups: Encrypted and stored securely for redundancy.
  • Error Reporting: Internal systems collect runtime data to diagnose issues.
  • In-Product Messaging: Delivers personalized, pseudonymized guidance.
  • Sonar Trust Center — request access to current certifications, SOC 2 reports, and compliance documentation.

How did we do?

Sonar and General Data Protection Regulation (GDPR)

Contact