How Sherlock protects customer data and systems
This page describes the safeguards Sherlock applies to customer information and the systems used to deliver its services. It also explains the current status of our independent assurance work.
Last updated October 2026
Security & compliance
Framework alignment and independent testing, presented with their current status.
Supporting materials can be requested for customer review.
NIST CSF 2.0
Aligned
Cybersecurity Framework
CCSS
Aligned
CryptoCurrency Security Standard
Third-party penetration testing
Bishop Fox
The controls behind Sherlock’s services
Our security program governs who can access production, how code changes reach it, and what happens when a security issue is found.
01
Access follows business need
Company, customer, and production access is limited by role. Privileged access requires approval before it is granted.
02
Changes move through controls
Code is held in controlled repositories. Build, test, deployment, and release workflows precede production changes.
03
Issues are tracked to response
Vulnerabilities are prioritized by risk and tracked through remediation. Incidents follow an escalation and containment process.
Customer data and production access
Sherlock protects information in transit, relies on its providers’ safeguards for stored data, and restricts who can reach production systems.
Connections in transit
Connections over public networks are encrypted in transit using industry-standard encryption protocols.
Data held by providers
Customer data stored with Sherlock’s cloud and application providers is protected using provider-supported encryption at rest and applicable security controls.
Production access
Access to production systems and customer information is restricted based on role and business need. Privileged access requires approval and access is reviewed and revoked when no longer required.
Infrastructure and providers in Sherlock’s security scope
Google Cloud
Vercel
Cloudflare
GitHub
How Sherlock handles code changes and security issues
Code changes
Sherlock maintains source code in controlled repositories. Changes are subject to review and testing and move through controlled build, deployment, and release processes before reaching production.
Vulnerabilities
Security vulnerabilities affecting in-scope systems are evaluated and prioritized based on risk and tracked through remediation.
Security incidents
Sherlock maintains a documented incident response process covering identification, escalation, containment, investigation, remediation, and recovery. External communications are handled in accordance with applicable contractual and legal obligations.
Also within the security program: third-party reviews, personnel security, and continuity and recovery practices.
Security materials for customer review
Review the status of our assurance work or ask for the materials relevant to your diligence process.
SOC 2 program in progress
Sherlock is implementing its security program toward SOC 2 alignment. An independent SOC 2 report is not yet available.