Compliance and Certifications (SOC 2, GDPR)
SOC 2-ready: controls aligned to SOC 2, formal Type II audit not yet completed. GDPR compliant.
Last updated July 22, 2026
Peony's current compliance posture. Some certifications are in progress, some are complete.
For encryption, hosting, and access control, see Security Overview.
SOC 2
SOC 2 Type II-ready: our controls are aligned to SOC 2, and the Type II audit is underway (via Sprinto).
Available right now for compliance reviews:
- Security whitepaper covering encryption, hosting, access control, audit logging, backups, incident response.
- Completed security questionnaires (CAIQ, vendor risk, Google Workspace vendor reviews).
- DPA for GDPR and standard vendor contracts.
Request any of these from deqian@peony.ink with your company name and review timeline. Typical turnaround: one business day.
GDPR
Peony is GDPR compliant for EU customers.
- Legal basis. Processing under legitimate-interest and contract bases (GDPR Article 6). Customer content processed only to deliver the service.
- DPA. Standard DPA with Standard Contractual Clauses (SCCs) for international transfers, on request from deqian@peony.ink.
- Data subject rights. Access, portability, correction, and erasure via the account owner or deqian@peony.ink. Most rights are self-serve from Settings.
- Hosting. Customer data hosted in AWS US by default. EU transfers governed by SCCs. EU-region hosting is available on the Enterprise plan.
EU-residency requirements: EU-region hosting is offered on Enterprise — contact sean@peony.ink before purchasing.
HIPAA
Peony can support HIPAA on a case-by-case basis. Contact sean@peony.ink to discuss your requirements.
CCPA
Peony respects CCPA rights for California residents: right to know, delete, and opt out of sale. Peony does not sell customer data. Submit requests to deqian@peony.ink.
ISO 27001, FedRAMP, Others
ISO 27001-ready — the audit is underway (via Sprinto), alongside our SOC 2 work. FedRAMP, ISO 27017, ISO 27018, and PCI DSS are not currently held; that part of the roadmap is driven by enterprise customer demand — if a certification is blocking procurement, contact sean@peony.ink.
Common Questions
"Can I get a signed DPA?" Yes — deqian@peony.ink.
"Do you have a completed security questionnaire?" Yes — deqian@peony.ink. Shared under NDA.
"Where is our data hosted?" AWS US region.
"Who on the Peony team has access to our data?" Production access limited to a small on-call rotation and support staff on active tickets. All access logged.
"What happens to our data if we cancel?" 30-day soft-delete window, then purged from primary storage. See Security Overview.
"Does Peony use our documents to train AI models?" No. LLM APIs operate under data-handling agreements that prohibit training on customer content.