What changed?
Peony's security pages and docs now state its compliance position in one consistent form:
- SOC 2 Type II-ready: controls aligned to SOC 2, Type II audit underway (via Sprinto).
- ISO 27001-ready: audit underway (via Sprinto), alongside the SOC 2 work.
- DPA: standard Data Processing Agreement with Standard Contractual Clauses, on request on Deal Team and Enterprise.
- BAA: Business Associate Agreement on request on Enterprise, with HIPAA requirements supported case by case.
FedRAMP, ISO 27017, ISO 27018 and PCI DSS are not currently held.
Who is it for?
Security reviewers and procurement teams assessing Peony, and buyers in healthcare and other regulated industries.
How does it work?
The details, including what each plan includes, are on the certifications page and the security overview.
Which plans include it?
The DPA is available on request on Deal Team ($64 per admin per month billed annually, $89 billed monthly) and Enterprise. The BAA is available on request on Enterprise. See pricing.
How does it compare?
Vendors describe compliance in different ways. Peony uses "ready" with "audit underway" until the audits complete, rather than "certified".
Where can I learn more?
Common questions
Is Peony SOC 2 certified?
Not yet. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway, run through Sprinto.
Will Peony sign a BAA or DPA?
Peony signs a BAA on request on the Enterprise plan, and a standard DPA with Standard Contractual Clauses on request on Deal Team and Enterprise.