Audited end to end. The same posture for 3,000+ clients.
Askable Labs runs on Askable's production platform. The Integrated Management System that serves 3,000+ clients across banking, health insurance, and other regulated industries underpins every sample in the catalogue, externally attested under SOC 2 Type II and certified to ISO/IEC 27001:2022, 27701:2019, and 42001:2023. Public certificates and the full controls catalog live on the trust portal.
Four certifications carrying the platform. Four more reinforcing it.
External attestations and certifications held by Askable apply directly to Askable Labs. The lab runs on Askable's production platform, not a parallel one. Everything below is testing the same Integrated Management System.
Public certificates are downloadable from the trust portal. The SOC 2 Type II report, penetration test summary, and ISMS policies are released under MNDA via the portal's request flow.
ISO/IEC 27001:2022
CertifiedInformation Security Management System. The international baseline for information security.
ISO/IEC 27701:2019
CertifiedPrivacy Information Management System. Extends ISO 27001 with privacy-specific controls for participant data.
ISO/IEC 42001:2023
CertifiedAI Management System. Governance for the responsible development and deployment of AI systems.
SOC 2 Type II
AttestedIndependent auditor attestation covering security, availability, and confidentiality over an audit window.
Where the controls live.
Recruitment, consent, capture, tagging, review, and delivery are code paths on one audited system, not procedures stitched across spreadsheets. Every action is authenticated, authorized, and logged on the same platform.
The six stages below each surface the controls enforced in code and the framework families that audit them.
Recruit
Consent
Capture
Review
Deliver
Retire
The questions a vendor review usually opens with.
The full FAQ, controls catalog, subprocessor list, updates timeline, and gated evidence requests live on the trust portal. Below are the three questions we get most often that don't fit cleanly into a security questionnaire.
Where is participant and session data stored?
Primary processing happens in AWS Australia. Specific regions per data class are documented in the subprocessor inventory on the trust portal. Partner-isolation, encryption at rest, and TLS in transit apply at every layer.
Can we get the SOC 2 Type II report, pen test summary, and ISMS policies?
Yes. Public certificates (ISO 27001, 27701, 42001, UK Cyber Essentials) are downloadable directly from the trust portal. The SOC 2 Type II report, penetration test summary, and internal policies are released under MNDA via the portal's "Request access" flow. Standard turnaround is under two business days.
What happens if a participant withdraws consent after a session has been delivered?
Source material on our side is cryptographically destroyed within the SLA. We relay the withdrawal request to the partner, but enforcement against material already ingested into the partner's environment is at their discretion under the partnership terms. This boundary is made explicit in the contract.
Detailed evidence, control mappings, subprocessors, and updates.
The trust portal is the live source of truth. It mirrors the live state of the production posture and is updated as the IMS changes.