---
title: "Peony virtual data room security: SOC 2 Type II-ready and ISO 27001-ready, audits underway"
lang: en
canonical_url: https://www.peony.ink/changelog/peony-security-compliance-soc-2-iso-27001-ready
description: "Since October 17, 2026, Peony has stated that its virtual data room is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. A DPA is available on request on Deal Team and Enterprise, and a BAA on request on Enterprise."
date: "2026-10-17T12:00:00.000Z"
author: "Sean Yu"
---

# Peony virtual data room security: SOC 2 Type II-ready and ISO 27001-ready, audits underway

_Security · October 17, 2026_

**Plans:** DPA: Deal Team and Enterprise, on request. BAA: Enterprise, on request.

**For:** Security reviewers, Procurement teams, Healthcare and regulated industries

Since October 17, 2026, Peony has stated that its virtual data room is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway. A DPA is available on request on Deal Team and Enterprise, and a BAA on request on Enterprise.

## What changed?

Peony's security pages and docs now state its compliance position in one consistent form:

- **SOC 2 Type II-ready:** controls aligned to SOC 2, Type II audit underway (via Sprinto).
- **ISO 27001-ready:** audit underway (via Sprinto), alongside the SOC 2 work.
- **DPA:** standard Data Processing Agreement with Standard Contractual Clauses, on request on Deal Team and Enterprise.
- **BAA:** Business Associate Agreement on request on Enterprise, with HIPAA requirements supported case by case.

FedRAMP, ISO 27017, ISO 27018 and PCI DSS are not currently held.

## Who is it for?

Security reviewers and procurement teams assessing Peony, and buyers in healthcare and other regulated industries.

## How does it work?

The details, including what each plan includes, are on the [certifications page](https://www.peony.ink/docs/security-compliance/certifications) and the [security overview](https://www.peony.ink/docs/security-compliance/security-overview).

## Which plans include it?

The DPA is available on request on Deal Team ($64 per admin per month billed annually, $89 billed monthly) and Enterprise. The BAA is available on request on Enterprise. See [pricing](https://www.peony.ink/pricing).

## How does it compare?

Vendors describe compliance in different ways. Peony uses "ready" with "audit underway" until the audits complete, rather than "certified".

## Where can I learn more?

- [Security](https://www.peony.ink/features/security)
- [Certifications (docs)](https://www.peony.ink/docs/security-compliance/certifications)

## FAQ

### Is Peony SOC 2 certified?

Not yet. Peony is SOC 2 Type II-ready and ISO 27001-ready, with both audits underway, run through Sprinto.

### Will Peony sign a BAA or DPA?

Peony signs a BAA on request on the Enterprise plan, and a standard DPA with Standard Contractual Clauses on request on Deal Team and Enterprise.

---

_Markdown version of [https://www.peony.ink/changelog/peony-security-compliance-soc-2-iso-27001-ready](https://www.peony.ink/changelog/peony-security-compliance-soc-2-iso-27001-ready.md) for AI agents and LLMs; canonical HTML: https://www.peony.ink/changelog/peony-security-compliance-soc-2-iso-27001-ready. Every page on peony.ink is available as markdown — append `.md` to the URL or request it with `Accept: text/markdown`. More: [llms.txt](https://www.peony.ink/llms.txt)._