01
The platform vendor
Hosts and runs the platform, holds its certifications (SOC 2, ISO 27001 and others) and operates its data centers, encryption and monitoring.
Trust center
Security and compliance for your platform projects
For procurement and security teams. See who is responsible for what, which certifications each platform holds, and how Sengo works when we have access to your systems.
Shared responsibility
Three parties, three roles
Security on a CMS or DXP project is shared. Knowing who owns what makes your security review faster.
02
Sengo
Configures, integrates, upgrades and supports the platform for you, with access limited to what the work needs.
03
Your organization
Controls your data. You decide who has access, which hosting region the vendor uses and how long information is kept.
Platform certifications
Certified platforms we implement
Sengo does not hold these certifications itself. They belong to each vendor and are published on the vendor's own security page.
Sitecore
- Security operations center with 24/7 monitoring
- External penetration testing and a bug bounty program
- Certifications and audit reports in the Sitecore Trust Center
Optimizely
- SOC 2 Type 2
- ISO/IEC 27001, 27017 and 27018
- PCI DSS and HIPAA-ready services on some products
Kentico
- SOC 2 (Xperience by Kentico SaaS)
- ISO/IEC 27001
- GDPR, CCPA and DORA programs
Coveo
- SOC 2 Type II, audited every year
- ISO/IEC 27001, 27017, 27018 and 27701
- HIPAA-compliant hosting, with data centers in Canada
Contentful
- SOC 2 Type 2 and SOC 3
- ISO/IEC 27001 since 2019
- PCI DSS SAQ A and TISAX
Storyblok
- ISO 27001 and TISAX
- GDPR and the EU-U.S. Data Privacy Framework
- Hosting on AWS, including Canada
Netlify
- SOC 2 Type II
- ISO/IEC 27001 and 27018
- PCI DSS and HIPAA safeguards
ai12z
- Encryption in transit and at rest
- States adherence to HIPAA, GDPR, PCI DSS and CCPA
- Customer data is not used to train AI models
Checked on each vendor's site in October 2026. Certifications can vary by product and plan; confirm the scope for yours with the vendor.
How we work
Our practices on your systems
What you can expect from Sengo's team when we work on your platform.
Least-privilege access
We ask only for the access the work needs, across application, infrastructure and operations.
Minimal data
Customer data is kept to a minimum, encrypted, access-controlled and kept only as long as needed.
Enterprise cloud hosting
We build on enterprise cloud providers with encryption in transit and at rest, network segmentation and DDoS protection.
Continuous monitoring
Defense in depth across application, infrastructure and operations, with continuous monitoring.
Governance
Written policies, vendor risk management and an incident response process.
Contracts
Legal agreements, including a data processing agreement (DPA), cover your obligations as a client.
Questions from security and procurement teams
Is Sengo SOC 2 or ISO 27001 certified?
No. Sengo does not hold these certifications itself. The platforms we implement are certified by their vendors, as listed on this page, and we follow the practices described above when we work on your systems.
Can our data stay in Canada?
It depends on the platform. Coveo and Storyblok both offer hosting in Canadian data centers. For other platforms, we help you choose among the regions the vendor offers and check what your contract covers.
Who signs the data processing agreement?
Each platform vendor has its own agreement with you for the data it hosts. Sengo provides legal agreements, including a DPA, for the work we do on your systems.
How do we send a security questionnaire?
Send it to security@sengo.com. Include your deadline and the platforms in scope.
Running a security review?
Send your questionnaire or your questions. We will tell you what we can document and what belongs to the platform vendor.