Current status

We want to state this clearly: ET Ducky is not yet SOC 2 audited. Our security whitepaper documents how our controls map to the SOC 2 Trust Services Criteria, ISO 27001 Annex A, NIST CSF, and GDPR Article 32 — but mapping is not certification, and we won't claim what we don't hold.

If you have a procurement requirement that depends on a SOC 2 attestation or signed BAA, contact us — we'd rather have an honest conversation about timelines than oversell what we have today.

Sub-processor certifications we inherit

Some of the controls in our environment are provided by third-party sub-processors that hold their own attestations.

• Identity & SSO: Clerk is SOC 2 Type II certified.
• Infrastructure: DigitalOcean holds SOC 2 Type II, SOC 3, ISO 27001, ISO 27017, ISO 27018, and PCI DSS attestations.
• Edge / WAF: Cloudflare holds SOC 2 Type II, ISO 27001, and PCI DSS attestations.
• Billing: Stripe is PCI DSS Level 1 certified.
• AI processing: Anthropic holds SOC 2 Type II.

Inherited controls reduce our scope but do not replace our own attestation.

Current list

The following third parties process customer data on ET Ducky's behalf as part of the cloud-hosted service. Self-hosted deployments do not transit data through any of these (except Anthropic when self-hosted customers configure Anthropic as their AI provider).

We will update this list when sub-processors change. If you require notification before sub-processor changes for contractual reasons, contact [email protected].

Scope

We welcome reports about vulnerabilities in:

• The etducky.com domain and all subdomains
• The ET Ducky agent (Windows Service and Linux systemd unit)
• The ET Ducky desktop application
• The cloud API and dashboard

Out of scope

• Reports against our sub-processors (please report directly to Clerk, DigitalOcean, Cloudflare, Stripe, or Anthropic per their own disclosure policies)
• Social engineering of ET Ducky staff or customers
• Physical attacks against our infrastructure or offices
• Denial-of-service testing — please don't attempt this against production
• Reports about missing security headers without a demonstrated exploit
• Reports about rate limits that don't lead to a demonstrable security impact

How to report

Email [email protected] with:

• A description of the vulnerability and where it lives
• Steps to reproduce (or a proof-of-concept)
• The impact you believe it has
• Your preferred name and contact details for follow-up

PGP encryption is available on request — ask for our public key.

What you can expect from us

• Acknowledgement within 3 business days
• Triage and initial assessment within 10 business days
• Status updates every 14 days until resolution
• Public credit in our security advisories if you'd like it (or anonymous if you prefer)
• No legal action against good-faith research that follows this policy

Safe harbor

If you make a good-faith effort to comply with this policy during your security research, we will not pursue or support legal action against you. We consider research conducted under this policy to be authorized under the Computer Fraud and Abuse Act and similar statutes, and exempt from our Terms of Service to the extent necessary to perform the research.

If something goes wrong

If we detect or are notified of a security incident that affects customer data, here is what happens:

1. Triage & containment — we identify scope and stop further exposure. The agent's network-isolation mechanism is available as a containment tool against compromised endpoints in customer environments.
2. Customer notification — if customer data is affected, we notify the affected organization's admin contacts directly. Our target is notification within 72 hours of confirmation, in line with GDPR Article 33 expectations.
3. Investigation & root cause — we publish a post-incident summary including timeline, scope, and remediation. Public-facing incidents are mirrored on status.etducky.com.
4. Remediation & follow-up — we share what we changed to prevent recurrence.

We have not had a security incident requiring customer notification to date. We will document any future incidents here.

How to reach us

• Vulnerability reports: [email protected]
• General security questions: [email protected]
• Procurement / compliance: [email protected] (ask for our security questionnaire response or current whitepaper)
• Machine-readable: see /.well-known/security.txt (RFC 9116)

More detail

Read the security whitepaper for the full architecture, encryption, isolation, and control-mapping documentation. See the Security documentation for product-level details on behavioral monitoring, isolation actions, and operator elevation.