Trust center
Security, privacy, and compliance by design.
KPMG Sofy is built on the same standards we help our clients achieve. Transparency about our security posture, certifications, and data practices is not an afterthought it is foundational to how we operate.
Our certifications
Built on certifications you can trust
SOC II Type II
Sofy is annually audited against the SOC II Type II framework, covering the Trust Service Criteria for Security, Availability, and Confidentiality. Our SOC II report is available to prospective and current customers under NDA.
ISO 27001
Sofy is certified against ISO/IEC 27001, the international standard for information security management systems. Our certification covers the full scope of the Sofy platform and supporting infrastructure.
GDPR / AVG
Sofy is fully compliant with the General Data Protection Regulation. All personal data is processed in accordance with applicable EU privacy legislation. We act as a data processor and maintain a full record of processing activities.
KPMG Global Standards
As a product of KPMG Advisory N.V., Sofy adheres to KPMG's global information security policies and risk management frameworks the same standards we apply when advising our clients on GRC.
Data & Privacy
How we handle your data
We believe in clear, straightforward data practices. Below is an overview of how Sofy processes, stores, and protects your data.
Data residency. All customer data is hosted within the European Union. Sofy uses Microsoft Azure infrastructure located in the Netherlands and Western Europe regions. Data is never transferred outside the EU without explicit customer consent.
Data separation. Every customer environment is logically separated. Your data is never shared with or accessible by other customers. Access is strictly controlled and audited.
Data retention. Customer data is retained for the duration of the contract and deleted within 30 days of contract termination, unless legal obligations require a longer retention period. Customers can request data deletion at any time.
Subprocessors. Sofy works with a limited number of trusted subprocessors to deliver our services. A full and up-to-date list of subprocessors is available upon request. We notify customers of any changes to our subprocessor list with a minimum of 30 days notice.
Security
How we protect your data
Shared responsibility
Security is a shared responsibility
Security is a shared responsibility between KPMG Sofy and our customers. Here is how responsibilities are divided.
KPMG Sofy is responsible for
- Security of the platform, infrastructure, and application layer
- Availability and performance of the Sofy environment
- Data encryption, access control, and audit logging at platform level
- Compliance with ISO 27001 and SOC II requirements
- Vulnerability management and security patching
- Incident detection, response, and customer notification within 72 hours
Customer is responsible for
- Management of user accounts and access rights
- Ensuring appropriate use of the platform
- Compliance with their own internal security policies and procedures
- Configuration of role-based access controls
- Timely reporting of suspected security incidents
- Ensuring end-user devices meet minimum security requirements
Incident response
What happens in the event of a security incident
In the event of a confirmed security incident affecting customer data, KPMG Sofy will notify affected customers within 72 hours of becoming aware of the incident — in accordance with GDPR Article 33 requirements. Notifications will include the nature of the incident, the data affected, the measures taken, and recommended actions for customers.
Our security team operates a defined incident response process covering detection, containment, eradication, recovery, and post-incident review. A summary of our incident response process is available upon request.