# Hyperproof - **Type:** Software product - **Website:** https://hyperproof.io - **Assessed by:** The Assurance Desk (Add-Venture Advisory Ltd) A US software platform that companies run to track audit evidence across more than 160 frameworks, including SOC 2, ISO 27001 and PCI DSS. It is not advice. ## Hyperproof scores Scored 1 to 5 on six criteria. There is no overall score. ### Help when things go wrong: 2/5 Hyperproof markets Compliance Management, Risk Management, Audit Ops and Third-Party Risk modules generically on its homepage, but no specific claim about ICO engagement, EU AI Act enforcement scenarios or a breach-response service was found on the pages checked (home, security, pricing, MSA). ### Qualifications of the people who do the work: 3/5 Hyperproof discloses SOC 2 (Security/Availability/Confidentiality scope, Type and auditor unstated), a third-party GDPR attestation (360 Advanced, January 2025, no findings) and FedRAMP Moderate for its separate Gov environment, all independently checkable, but names no CISO or security executive and claims no ISO/IEC 27001 or ISO/IEC 42001 certification for itself. ### What it publishes about fees: 1/5 hyperproof.io/pricing publishes no dollar figures or tiers; every call to action is 'Get a Demo' or 'See Hyperproof in action', with pricing fully gated behind a sales conversation. ### Knowledge of your sector: 4/5 hyperproof.io/solutions names distinct offerings for Healthcare, Technology, Fintech, Aviation and Manufacturing verticals alongside a 160+ framework library (HIPAA, PCI DSS, SOC 2, ISO 27001, CMMC), though the depth of tailoring within each vertical page was not independently verified. ### Independence from what it sells: 4/5 Hyperproof's compliance claims about its own product rest on independent checks, a named third-party GDPR attestation from 360 Advanced (dated, no findings) and a SOC 2 report, rather than self-declared marketing, though it lacks an accredited ISO/IEC 27001 or 42001 certificate and does not name its SOC 2 auditor or report type, short of the strongest disclosure in this set (e.g. Vanta's ANAB-accredited ISO 42001 certification). ### Who carries the risk if the advice is wrong: 4/5 Hyperproof's Master Subscription Agreement discloses a 99.5% uptime SLA with 10-20% service credits and a numeric liability cap (fees paid in the preceding 12 months, doubled to 2x for data-protection-related claims), clear engagement and liability terms, though no named professional-indemnity insurance product was found. ## Sources for Hyperproof Every line carries the page it was read on and the date it was checked. - SEC EDGAR confirms the legal entity and CIK behind Hyperproof's Form D filings - Source: https://www.sec.gov/cgi-bin/browse-edgar?action=getcompany&CIK=0001758546&type=D&dateb=&owner=include&count=40 - Checked: 2026-09-20 - Hyperproof's own Master Subscription Agreement states its current legal entity, jurisdiction and governing law - Source: https://hyperproof.io/msa/ - Checked: 2026-09-20 - Own security certifications disclosed by Hyperproof - Source: https://hyperproof.io/security/ - Checked: 2026-09-20 - Pricing is not published anywhere on the site - Source: https://hyperproof.io/pricing/ - Checked: 2026-09-20 - Approved-subprocessor list names AI-tagged vendors but no foundation-model provider - Source: https://hyperproof.io/approvedsubprocessors/ - Checked: 2026-09-20 - SLA and liability terms are disclosed in the Master Subscription Agreement - Source: https://hyperproof.io/msa/ - Checked: 2026-09-20 - No CISO or named security executive appears on the leadership page - Source: https://hyperproof.io/about/ - Checked: 2026-09-20 ## What this provider publishes Not published means we did not find it on the firm's own pages. - Price: Not published - Indemnity cover: Published - Credentials: Not published - Independent accreditation: Published - Client results: Published - How it uses AI: Published ## Strengths - Publishes a specific SLA (99.5% uptime) with tiered service credits and numeric liability caps, including a doubled cap for data-protection-related liability, rather than leaving availability and liability undefined. - Discloses a named third-party GDPR compliance attestation (360 Advanced, January 2025, no findings) in addition to a SOC 2 report, going beyond generic security marketing language. - Names distinct industry-vertical offerings (healthcare, fintech, aviation, manufacturing, technology) rather than one templated product for every sector. - Publishes named, quantified customer case studies (Acuity International: 70% reduction in GRC workload; Omnistruct: 660% increase in client service capacity) rather than only generic testimonials. ## Things to check Each one carries the factual basis it rests on. - No ISO/IEC 27001 or ISO/IEC 42001 certification is disclosed for Hyperproof's own operations, unlike close competitors Vanta, Drata, Secureframe and OneTrust, which all hold ISO 27001 and, for three of them, ISO 42001 too. - Basis: hyperproof.io/security/, checked 2026-09-20, discloses only SOC 2, a GDPR third-party attestation and FedRAMP Moderate (Hyperproof Gov environment only); no ISO 27001 or ISO 42001 claim appears anywhere on that page. - No CISO or other named security executive is published, weaker than Vanta (names CISO Jadee Hanson) and Secureframe (names CISO Drew Daniels). - Basis: hyperproof.io/about/, checked 2026-09-20, lists 15 named executives across CEO/COO/VP/SVP roles in sales, product, engineering, marketing and finance, none titled CISO or Head of Security. - No pricing figures are published anywhere on the site; every tier and page routes to a 'Get a Demo' request rather than a self-service quote or published rate card. - Basis: hyperproof.io/pricing/, checked 2026-09-20, shows no dollar figures and only 'Get a Demo' / 'See Hyperproof in action' calls to action. - The subprocessor list flags Microsoft Azure, Google and Intercom/Fin as handling 'AI' processing but does not name the underlying AI model or foundation-model vendor, so a buyer cannot tell which model actually processes their data through Hyperproof AI. - Basis: hyperproof.io/approvedsubprocessors/, checked 2026-09-20, tags Microsoft Azure, Google and Intercom/Fin with 'AI' but names no LLM/foundation-model provider anywhere on the page. ## Where this firm appears - [Can the firm that prepares you also certify you?](https://theassurancedesk.com/best/certification-seeking) - [Your sector adds its own rules to UK data protection law](https://theassurancedesk.com/best/sector-regulated) - [Compare providers](https://theassurancedesk.com/compare) --- **Scope.** The Assurance Desk covers data protection, AI governance and cyber security in the United Kingdom and the United States. It scores providers in both: UK-facing firms, and firms based in the United States. Every provider scored so far was selected for data-protection, AI-governance or security-assurance work. Where a page describes law, it names the country that law applies in. **Who publishes this.** The Assurance Desk is published by Add-Venture Advisory Ltd, company number 11854524, registered in England and Wales. The same owner runs Avouch, a marketing agency that sells AI visibility services to firms of the kind this site covers. That is a conflict of interest, and it is disclosed here. **Corrections.** If you represent this firm and something here is wrong or out of date, email hello@theassurancedesk.com with the evidence.