Compliance

Reports, certificates and who is responsible for what

Independent auditors examine our controls every year. Their reports are confidential to us and our customers, so we do not publish them here, but we will send them to you under a non-disclosure agreement, usually within a day.

01 Reports

What we hold

Report	Scope	Period	Issued by
SOC 1 Type II	Controls relevant to customers’ financial reporting: physical access, environmental controls, change management	Annual, twelve months to September 30	Independent CPA firm
SOC 2 Type II	Security and availability trust services criteria	Annual, twelve months to September 30	Independent CPA firm
ISO/IEC 27001:2022	Information security management system covering colocation, interconnection and remote hands at both sites	Three-year certificate, surveillance audits annually	Accredited certification body
PCI DSS v4.0.1	Attestation of compliance as a service provider for the physical security requirements	Annual	Qualified security assessor
HIPAA	Independent assessment of the physical safeguards; business associate agreement available	Annual	Independent assessor

Both sites are in scope for every report. Bridge letters covering the months between the end of a SOC period and the date you ask are available on request.

02 Shared responsibility

Who is responsible for what

Control area	Cordgrass	Customer
Building, power, cooling, fire protection	Cordgrass	—
Physical access to the building, halls and your space	Cordgrass	Keeping your access list current
Video recording and retention	Cordgrass	Asking for masking inside your space, if you want it
Remote hands records	Cordgrass	Authorizing requests
Your equipment, its configuration and its data	—	You
Logical access to your systems	—	You
Encryption, backups, disaster recovery	—	You, using one site or both

Colocation customers are responsible for everything inside their cabinets. We never have logical access to customer systems, and our remote hands will not sign in to them; see remote hands.

03 Requests

Asking for evidence

Ask your account manager, or write to sales@cordgrassdata.com if you are not yet a customer. For an audit of your own, we can provide access logs, visitor records and remote hands tickets for your space, and host your auditor on site by appointment. Video is kept for 90 days and released only to the customer whose space it shows, or as the law requires.