22 Oct 2026, 09:55 UTC · 2 questions · ID 2ff24863613a
Who asked
Persona
CTO (Chief Technology Officer)
Company
Whirlpool Corporation
Industry
Manufacturing
Pages visited (3)
/
/products/data
/securityQuestions 1 and 2 asked here
Question 1
“Do you have SOC 2 Type II, and how do we get the report?”
Answer
✕Not answered
The site covers security controls such as encryption, single sign-on, audit history and field-level permissions. It never says whether Hourglass holds SOC 2 Type II or any other certification, or how to request an audit report.
Add a certifications and audit reports section to /security
Who needs it: CTOs and IT or security reviewers checking a vendor (this visitor: CTO, Whirlpool Corporation)
What is missing
Whether Hourglass holds a SOC 2 Type II report is not stated.
No other compliance certifications or attestations are listed.
There is no way described to request an audit report, such as under NDA or through a trust portal.
Where
New section on /security, placed after "Security and control, built into every hub".
Related sections
Security and control, built into every hub · Encryption · Audit history · Data region choice
Main topics
Certifications and attestations held · Audit period and auditor scope · How to request reports · NDA or trust portal access · Security review questionnaires
What to do
Confirm with the security and compliance team which certifications and attestations Hourglass holds, their scope and their current audit periods.
Confirm the process for sharing reports, such as an NDA, a trust portal or a request through the contact page, and who handles requests.
Add the section listing each certification with the request route and a link to request a report.
Done when: /security names each certification Hourglass holds and explains how to request its report.
Add security and certifications pointer to /solutions/manufacturing
Who needs it: Manufacturing (this visitor: Whirlpool Corporation)
What is missing
The manufacturing page says nothing about security, certifications or audit reports for IT reviewers at manufacturers.
Where
Update this section: add a third card beside "Quotes from your real price lists" and "Service history on every ticket".
Related sections
Security and control, built into every hub
What to do
Add a card on security and compliance for manufacturers, summarising the certifications confirmed for /security.
Link the card to the new certifications section on /security.
Done when: /solutions/manufacturing has a security card that links to the certifications section on /security. Depends on: “Add a certifications and audit reports section to /security”
Add certifications to "Built for regulated teams" on /solutions/financial-services
Who needs it: Financial services (banks, credit unions and insurers)
What is missing
The regulated-teams section mentions auditors and approvals but names no certifications such as SOC 2 Type II.
There is no route for compliance teams to request audit reports.
Where
Update this section: add a line under "Approvals where you need them", after "Ready when your auditors ask".
Related sections
Security and control, built into every hub
What to do
Add a line naming the certifications confirmed for /security.
Link it to the report request route on /security.
Done when: /solutions/financial-services names Hourglass's certifications and links to how to request the reports. Depends on: “Add a certifications and audit reports section to /security”
Answer full page
I don't have information about a SOC 2 Type II report or how to request it. The site covers Hourglass security controls such as encryption, audit history, single sign-on and field-level permissions, but not certifications. I can put you in touch with the team to get you a clear answer on the report.
“Where would our data be stored, is it encrypted, and can we limit who sees each field?”
Answer
Partly answered
Encryption in transit and at rest and field-level permissions by role and team are covered, and the site says you can choose where data is stored. It never lists which data regions are offered.
Who needs it: CTOs and IT or security reviewers checking a vendor (this visitor: Whirlpool Corporation)
What is missing
The data regions a workspace can be stored in are not named.
It does not say whether the region can be changed after the workspace is created.
Where
Update this section: expand the "Data region choice" card, beside "Encryption" and "Field-level permissions".
Related sections
Create your workspace (on /get-started)
What to do
Confirm with engineering and the security team which data regions are offered and whether a workspace can move region later.
Add the confirmed region list and the change policy to the card.
Make the "choose your region" mention on /get-started consistent with the confirmed list.
Done when: /security names every data region a customer can choose and whether the region can be changed.
Answer full page
This page shows the security controls that answer all three: you choose the data region your workspace lives in, your data is encrypted, and field-level permissions decide who can see and change each field. The docs article below lists the regions you can choose from.