Safeguarding your data is at the heart of everything we do. Litmos was built for businesses that demand uncompromising protection of customer information, uninterrupted service, and transparent governance. That commitment is independently verified through our SOC 2® Type II examination* and ISO 27001:2022 certification, two globally respected benchmarks for cloud service‑ security.
Our Commitment to Information Security
- Executive-level O‑versight: Information security is governed at the highest levels of Litmos and guided by an internal Security Guild—which is a cross-‑functional forum that meets regularly to review risks, metrics, and improvement opportunities.
- Security First C‑ulture: Every employee completes annual security ‑awareness training, while software engineer and cloud engineer roles receive additional role-based‑ instruction covering secure coding, threat modeling, and infrastructure hardening.
- 24 × 7 Monitoring and Security Operations Center: Our cloud platforms are continuously observed by a dedicated Security Operations Center, leveraging real-time‑ telemetry, threat intelligence, and automated alerting to detect and respond to anomalies around the clock.
- Independent Assurance: Litmos engages accredited security consultancies to perform comprehensive external penetration tests annually, validating that our defenses remain effective against emerging threats.
- Third-party Risk M‑anagement: We operate a formal vendor risk program that tiers service providers by criticality, performs periodic reassessments, and publishes an up-to-date‑ sub-processor list.
- Global Data Residency and Privacy: Customers can choose to host data in several regions including the EU, Australia, or United States to meet regional compliance needs. Litmos has certified to the US Department of Commerce that it adheres to the U.S.–EU Data Privacy Framework, the UK Extension to the EU-US DPF, and the Swiss-US DPF with regard to the processing of personal data received. To view our certification please visit the official registry. Litmos is committed to protecting the individual’s privacy and compliance with all applicable privacy laws which is crucial to the future of business.
- Standards A‑ligned controls: In addition to SOC 2 type 2 and ISO 27001, our controls map directly to the CIS Critical Security Controls v8 (CIS 18), providing a familiar reference for security and audit teams.
What Is SOC 2® Type II?
Developed by the American Institute of CPAs (AICPA), the System and Organization Controls (SOC) 2 framework evaluates a service organization’s controls against five Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity, and Privacy. A Type II report goes a step further than a SOC 2 Type I, assessing not only design but also the operational effectiveness of controls over a minimum of 12 months.
Key highlights of our latest examination:
- Full 12‑month audit period 4/1/2024-3/31/2025
- Independent audit performed by a licensed CPA firm, Aprio, LLC
- No exceptions noted across in-scope‑ controls covering infrastructure, software, personnel, data, and procedures
Need the full report? Prospective customers under NDA can request it via their AM or AE. If the request is from a current customer, there is no NDA needed and they can reach out to request from their CSMs. Not sure who your CSM is? Submit a ticket through the customer portal.
What Is ISO 27001:2022?
ISO/IEC 27001 is the international standard for establishing, implementing, maintaining, and continually improving an Information Security Management System (ISMS). Certification demonstrates that Litmos systematically identifies information security‑ risks, applies proportionate controls, and drives an ongoing cycle of Plan–Do–Check–Act improvements.
Certification Scope:
- SaaS platforms: Litmos LMS, Litmos Training Ops (LTO), and supporting cloud services
- Corporate functions: Product engineering, cloud operations, customer support, and governance functions
Certification was issued by Aprio, LLP (ISO/IEC 17021accredited) following a Stage 1 readiness review and Stage 2 certification audit completed in ‑January of 2025.
📄 Download: ISO 27001 Certificate (PDF)
Why This Matters to You
- Accelerated Vendor Due Diligence‑: Our third-party‑ attestations shorten your security questionnaire cycle and provide immediate assurance.
- Regulatory Alignment: SOC 2 type 2 and ISO 27001 controls map to GDPR, CCPA, and other privacy laws and regulatory requirements, helping you maintain compliance.
- Operational resilience: Independent validation proves our ability to protect availability and confidentiality with monitoring and alerting in place to gauge and manage any disruption—so you can focus on your core business.
* Certified by ANAB to ISO/IEC 27001
