Security and trust

FactorFox is working toward SOC 2. A formal compliance program is under way and completion is targeted for the end of 2026. That is a statement about work in progress. It is not a certification claim and should not be read as one.

We hold no SOC 2 report today. Until one exists we will not describe FactorEvo as certified, compliant, attested or audited. When a report exists this page will name it, state its type and audit period, and explain how to request it under a confidentiality agreement.

The full control surface for the FactorFox platform family, written for the person completing a security questionnaire, is published on the FactorFox security and controls page. Every control described there can be demonstrated against a running environment.

If you are reviewing FactorEvo for a bank, a lender, an auditor or your own information security function, send your questionnaire to sales@factorfox.com with security review in the subject line. We answer it against the running platform rather than from a template, we tell you plainly which rows we cannot answer yet, and we will walk your reviewers through the controls live under a confidentiality agreement where you need one.

If you believe you have found a vulnerability in factorevo.com or in FactorEvo, write to sales@factorfox.com with security report in the subject line, or call (800) 616-3897. Include enough detail for us to reproduce it.

• Give us reasonable time to investigate and fix the issue before you share it with anyone else.
• Do not access, change or keep data that is not yours, and stop as soon as you have shown the issue.
• Do not degrade the service for other users, and do not use social engineering or physical attacks.

We will acknowledge your report, keep you informed while we work on it, and credit you once it is fixed if you would like to be named. Our contact details are also published in machine readable form at /.well-known/security.txt.

factorevo.com is a static site. It has no forms, sets no cookies, loads no third party scripts and serves its typefaces from its own origin. The only thing it stores is your light or dark theme choice, in your own browser. The details are in our privacy policy.

How the FactorEvo application handles personal information, including data about your clients, carriers and debtors, is described in the platform privacy notice.