The Sales Readiness Platform Trusted by Global Enterprise Organizations

SOC2

• Mindtickle has audited its platform against the Trust Service Principles and Criteria prescribed by The American Institute of Certified Public Accountants (AICPA) and obtained a Service Organization Control 2 (SOC2) Type 2 report.
• This third-party assurance audit is performed on an annual basis to obtain an independent opinion on the suitability of the design and operating effectiveness of the implemented controls. Our SOC2 Type 2 report can be shared on request with customers and prospects.

GDPR

• Mindtickle is fully compliant with General Data Protection Regulation (GDPR), a European Union (EU) law on data protection and privacy for all individuals within the EU and the European Economic Area (EEA) and their personal data exported outside the EU and EEA.
• We offer GDPR-compliant Data Processing Addendum (DPA) to provide our customers privacy protection assurance and to comply with our obligations as a Data Processor and help our customers meet their obligations as the Data Controllers. More details on our GDPR compliance can be accessed here.

CCPA

• Mindtickle is fully compliant with applicable provisions of California Consumer Privacy Act (CCPA), a state-wide statute intended for enhancing the data privacy and consumer protection rights for residents of California, United States (CA-US).
• We offer CCPA-compliant Data Processing Addendum (DPA) to provide our customers privacy protection assurance and to comply with our obligations as a Service Provider and help our customers meet their obligations as the business entities. More details on our CCPA compliance can be accessed here.

UK DPA

• Mindtickle is fully compliant with applicable provisions of the UK Data Protection Act (UK DPA) 2018, the United Kingdom’s national law, that complements the European Union’s General Data Protection Regulation (GDPR) replaces the Data Protection Act 1998.
• We offer UK DPA-compliant Data Processing Addendum (DPA) to provide our customers with privacy protection assurance and comply with our obligations as a Data Processor and help our customers meet their obligations as the Data Controller.

UK International Data Transfer Addendum

• Mindtickle is fully compliant with the provisions of Article 46 of the UK GDPR and offers an International Data Transfer Addendum (IDTA) issued by the Information Commissioner’s Office (ICO) under Section 119A of the Data Protection Act 2018.
• The IDTA acts as a transfer tool that allows organizations to transfer personal data outside of the UK. The addendum is part of Mindtickle’s pre-signed Data Processing Addendum (DPA) offered to its customers.

EU Standard Contractual Clauses

• The Commission Implementing Decision (EU) 2021/914 of 4 June 2021 to transfer personal data to third countries under Regulation (EU) 2016/679 of the European Parliament and the Council published New Standard Contractual Clauses (SCCs, also known as Model Contractual Clauses) to help safeguard European personal data.
• Mindtickle has incorporated the new SCCs into our Data Processing Addendum to help protect our customers’ data and meet the requirements of European privacy legislation.
• Although invalidated, Mindtickle continues to remain certified under both EU-U.S. and Swiss-U.S. Privacy Shield Frameworks.

APEC PRP Compliance

• The Asia-Pacific Economic Cooperation (APEC) has designed the APEC Privacy Framework to provide an accountable approach to managing data privacy protection and the flow of personal information across borders.
• Mindtickle, as a data processor, can demonstrate its adherence to APEC Privacy Framework and assist personal information controllers in complying with relevant privacy obligations by providing assurance around baseline requirements through completed standard intake questionnaire required for Privacy Recognition for Processors (PRP) compliance. You can access Mindtickle’s APEC PRP self assessment form here.

CSA STAR

• Mindtickle is compliant and certified as Level 1 with Security, Trust and Assurance Registry (STAR), an Open Certification Framework developed by Cloud Security Alliance (CSA) to promote best practice in the security assurance within Cloud Computing.
• Mindtickle has completed the CSA Consensus Assessments Initiative Questionnaire (CAIQ), which provides visibility into Mindtickle’s processes and practices followed to ensure security, confidentiality, and integrity of customer information. You can access Mindtickle’s registry entry here.

HIPAA

• Mindtickle is compliant with U.S. Health Insurance Portability and Accountability Act of 1996 (HIPAA) and undergoes an annual third-party HIPAA assessment to review our controls around privacy of individually identifiable health information as defined in the Privacy Rule and security of Electronic Protected Health Information as defined in the Security Rule.

• Our HIPAA compliance report can be shared upon request with customers and prospects. We also offer HIPAA-compliant Business Associate Agreement (BAA) to our customers who are subject to HIPAA.

21 CFR Part 11

• Mindtickle is compliant with GxP regulation enforced by the US Food and Drug Administration (FDA) and defined in Title 21 of the Code of Federal Regulations (21 CFR) Part 11. We have implemented controls for computer systems that create, modify, maintain, archive, retrieve, or distribute electronic records under GxP-regulated activities.

• The third-party independent assessment is performed on an annual basis to ensure our ongoing compliance with 21 CFR Part 11. Our 21 CFR Part 11 compliance report can be shared on request with customers and prospects.

SIG

• The Standardized Information Gathering (SIG) questionnaire, developed by Shared Assessments, offers a comprehensive set of questions to evaluate service providers’ risk controls. Organizations widely use SIG to manage their Third-Party Risk Management (TPRM) programs.

• Mindtickle has assisted multiple customers in their TPRM compliance journey by providing information as necessary for the SIG questionnaire and associated documentation. Our SOC2 controls are aligned to meet the compliance obligations set forth by the SIG questionnaire.

FINRA

• U.S. Securities and Exchange Commission (SEC) Rule 17a-4 outlines the requirements for broker-dealers that fall under the Financial Industry Regulatory Authority (FINRA) jurisdiction to create, preserve and furnish a comprehensive record of each securities transaction.
• Mindtickle helps customers in the financial services industry to meet the applicable FINRA compliance requirements. We have implemented technical and organizational measures to comply with the SEC Rule 17a-4 clause around data retention, indexing, accessibility, and format.