Request a Quote Quote

Raxis Trust Center

SOC 2, insurance, data handling, and the credentials behind every Raxis test, in one place.

Last update: June 16, 2026 Reviewed by: Mark Puckett

Compliance & Attestations

SOC 2 Type 2

Raxis has completed a SOC 2 Type 2 examination covering the Security Trust Services Criteria for the Raxis Pentesting Services System. The examination was performed by an independent CPA firm and evaluates the design and operating effectiveness of controls over the review period.

SOC 2 reports are available under NDA to current and prospective clients.

Insurance Coverage

Raxis maintains comprehensive insurance coverage including Commercial General Liability, Professional Liability (Errors & Omissions), Cyber Liability, Umbrella/Excess Liability, and Workers’ Compensation. Our policies are reviewed and renewed annually.

Certificates of insurance and coverage details are available upon request.

Data Handling & Client Privacy

During Engagements

  • All testing data is transmitted over encrypted channels using TLS 1.2+, VPN, or the Raxis Transporter
  • Findings are delivered exclusively through the Raxis One portal, secured with role-based access controls and full audit logging
  • Every engagement is scoped and bounded by signed Rules of Engagement before work begins
  • Raxis testers operate under strict policies against damaging or destroying customer property
  • Emergency escalation procedures are established for each engagement

After Engagements

  • Client data is retained in accordance with contract requirements and applicable retention schedules
  • Data destruction is available upon request and is executed through a formal approval and tracking process
  • Raxis does not sell client data or repurpose it for unrelated use, and does not disclose client identities or engagement details without authorization except as required by law.

Confidentiality

  • All engagements are covered by NDA, MSA confidentiality terms, or equivalent written confidentiality obligations before project kickoff.
  • Raxis employees and contractors with access to sensitive data are subject to background checks at hire and periodically as required by role, client requirements, or internal policy.
  • Client identities and engagement details are never disclosed without written consent

Operational Security

Secure Testing Infrastructure

Raxis One Portal, Project communications, findings, evidence, and reports are delivered through Raxis One, which is included in the Raxis Pentesting Services System covered by our SOC 2 Type 2 examination. Raxis One supports role-based access controls, encrypted transmission, and audit logging.

Raxis Transporter, Our internally developed remote access solution provides secure, on-site-equivalent testing to any location in the world. No VPN credentials or persistent network access required.

Internal Security Practices

  • Penetration testing on our own infrastructure at least annually; vulnerability scans performed quarterly
  • Endpoint protection deployed across all company devices
  • Multi-factor authentication required for all internal systems
  • Security awareness training completed by all employees and contractors upon hire and annually thereafter

Rules of Engagement

  • Every engagement begins with a formally signed scope document and rules of engagement
  • Testing windows and emergency contacts are confirmed before testing starts
  • Testing can be paused immediately upon client request at any time

Compliance Frameworks We Support

Raxis delivers penetration testing and security assessments aligned with the following compliance frameworks and regulations:

Framework Description
PCI DSS v4.0.1 Payment card industry security testing, including Requirement 11.4 internal and external penetration testing and segmentation validation where applicable.
HIPAA Security testing supporting risk analysis, risk management, and evaluation activities under the HIPAA Security Rule.
SOC 2 Penetration testing, vulnerability management, and remediation evidence supporting the Security Trust Services Criteria.
SOX IT general controls and security testing evidence supporting financial reporting control environments.
GLBA / Safeguards Rule Security testing and assessment support for financial institutions’ customer information protection programs.
NIST SP 800-171 / CMMC Security assessment support for organizations protecting controlled unclassified information and defense contractor environments.
ISO 27001 Technical security testing and remediation evidence supporting an information security management system.
GDPR Security testing supporting Article 32 expectations for regularly testing, assessing, and evaluating technical and organizational security measures.
FERPA Security testing support for educational institutions protecting student data and related systems.
NYDFS Cybersecurity Regulation Penetration testing, vulnerability management, and security assessment support for covered financial services entities.
MITRE ATT&CK Adversary tactics, techniques, and procedures mapping for red team and detection validation engagements.

Team Certifications

Raxis penetration testers hold top industry certifications that validate deep technical skill and hands-on security expertise. Our certifications represent more than exams, they back the advanced techniques and adversary simulations we deliver every day. If you have a request for a particular certification, we will try to accommodate, however this list is intended to show our commitment to hiring the industry best.

Offensive Security

OSCP, OSCE, OSWE, OSWP, OSEP

SANS / GIAC

GPEN, GCIH, GFACT, GMON

ISC² / ISACA

CISSP, CISM, CISA, ISSAP

EC-Council

CEH, LPT Master, CSA

CompTIA

Security+, PenTest+, CySA+, SecurityX

Platform & Specialty

CRTO, eCPPTv2, eJPT, CBBH, CPTS, PJPT, PNPT, AWS Cloud Practitioner, Splunk Certified Admin, Rapid7 Network Assault, APISec Certified API Security Analyst, CCD, CloudNetX

Recognition

  • We’re recognized by major market research firms to be a key player in our space, including Markets and Markets PTaaS, Penetration Testing, and US Penetration Testing.
  • Raxis holds a perfect 5.0 rating on Clutch across verified client reviews. Each year, Raxis performs over 600 penetration tests and successfully retrieves protected data in over 85% of Red Team engagements.
  • Raxis engineers have discovered and disclosed 12 vulnerabilities assigned CVE identifiers through MITRE. See our security research.
  • Raxis is listed as a Sample Vendor for Penetration Testing as a Service (PTaaS) in two Gartner® Hype Cycle™ reports for both 2023 and 2024: Hype Cycle for Security Operations and Hype Cycle for Application Security.

Raxis Vulnerability Research

Our engineers find flaws in the products themselves, not just in how they are deployed. When we do, we report the issue to the vendor, coordinate a fix, and it is assigned a CVE identifier through MITRE. To date we have 12 CVEs across ManageEngine, PRTG Network Monitor, Nagios XI, and Rock RMS.

The full list, with links to each CVE record, its NVD entry, and our technical writeup, is on our Security Research page.

Questions About Our Security Posture?

We believe in transparency. If you need additional documentation, including our SOC 2 report, proof of insurance, or details about our security practices, we’re happy to provide it. Just let us know what you’d like to see via our Contact Form.

Request a quote

Tell Us What You Need Tested

We usually respond in one business day.

Please let us know what's on your mind. Include any details about your target environment, timeline, or compliance drivers.