generated: '2026-08-13'
method: searched
source: >-
  https://www.act.com/uploads/act_security_privacy_whitepaper.pdf (Act! Products
  Security and Privacy whitepaper, 7 pages, fetched 2026-08-13),
  https://www.act.com/resources/soc-compliance/ and
  https://www.act.com/legal/privacy-policy/.
description: >-
  Act! has no trust-center portal — no Vanta/Drata/SafeBase page, no
  self-service report request. What it publishes is a downloadable Security and
  Privacy whitepaper that names its audits and its hosting posture, plus a
  marketing page explaining what SOC 2 and SOC 3 mean. The audit reports
  themselves are gated: the SOC 2 report requires an NDA and the SOC 3 report is
  "available on request".
trust_center_portal: false
portal_url: null
documents:
  - name: Act! Products Security and Privacy whitepaper
    url: https://www.act.com/uploads/act_security_privacy_whitepaper.pdf
    http_status: 200
    fetched: '2026-08-13'
    pages: 7
    note: >-
      Marked "Confidential & Proprietary" in its own footer while being served
      unauthenticated from the site footer link.
  - name: SOC Compliance resources
    url: https://www.act.com/resources/soc-compliance/
    http_status: 200
    fetched: '2026-08-13'
    note: >-
      Educational — explains the difference between SOC 2 and SOC 3 and links a
      free PDF. It does NOT itself assert an Act! certification; the
      certification claims live in the whitepaper above.
  - name: Act! Global Privacy Policy
    url: https://www.act.com/legal/privacy-policy/
  - name: Terms of Service
    url: https://www.act.com/legal/terms-of-service/
certifications:
  - name: SOC 2
    status: claimed
    scope: Act! Premium Cloud
    evidence: >-
      "This entire process has been validated by the SOC 2 audit process"; Act!'s
      vendor selection process "has been evaluated as SOC 2 compliant"; database
      access during support follows "a SOC 2-compliant process"; SOC 2-compliant
      Emergency Response and Business Continuity processes.
    report_access: NDA required
    auditor: not named
    period: not stated
  - name: SOC 3
    status: claimed
    scope: Act! Premium Cloud
    evidence: '"the SOC 3 Audit Report (available on request)"'
    report_access: available on request
    note: >-
      A SOC 3 report is designed for public distribution. Act! gates it behind a
      request anyway, which is the opposite of how the report type is meant to
      work and is the single easiest credibility upgrade available here.
  - name: ISO 27001
    status: not claimed
  - name: PCI DSS
    status: not claimed
    note: >-
      Act! Payments accepts card payments, but no PCI attestation is published
      in the whitepaper or on the payments product page.
  - name: HIPAA
    status: not claimed
  - name: FedRAMP
    status: not claimed
security_posture_published:
  hosting: Amazon Web Services; end-user data-center region defaults from billing postal code. Act! stores no customer databases at its office locations.
  tenancy: Each customer database is stored and backed up as an independent database.
  encryption_in_transit: TLS 1.2 (whitepaper states "currently (July 2023), we support TLS 1.2")
  encryption_at_rest: SHA 256 (as worded in the whitepaper)
  backups: Daily, encrypted, stored off the database server.
  mfa: Available on Act! Premium Cloud; enforced on the AWS Management Console.
  endpoint_protection: Anti-virus/endpoint protection on every server, updated daily.
  monitoring: 24/7 threat monitoring in partnership with Rapid7; engineer on duty outside business hours.
  privileged_access: AWS console access limited to teams of four or fewer screened employees, restricted to the internal network or VPN, reviewed daily by a Director-level role.
  support_access: Act! employees do not access a customer database without documented customer consent.
findings:
  - >-
    The whitepaper's encryption statements are dated July 2023 and stop at TLS
    1.2. Live probing on 2026-08-13 found www.act.com and developer.act.com
    negotiating TLS 1.3, but the API host apimta.act.com negotiating TLS 1.2 —
    so the API is the laggard, and the published document has not been revised
    in three years. See security/act-domain-security.yml.
  - >-
    "encrypted at rest, SHA 256" describes a hash, not a cipher. The intended
    claim is presumably AES-256; as written the statement does not say what it
    means.
  - No ISO 27001 and no PCI DSS attestation published despite shipping a payments product.