SOC 2 compliance, where is the data residency, and what information is stored in the endpoints?

[avd 0]

Hello,

I have purchased ESET PROTECT Entry for one client and plan to possibly acquire another license for another client, but I need more information about a few topics that I cannot find online.

First question: Is ESET SOC2 compliant? What regulatory/compliance certifications does ESET hold? I know they have ISO certificate as I can find this online.

Second question: Where is data residency? I believe the datacenters are in Sweden - is this correct? Is this where all data is stored? Is a known cloud provider utilized?

Third question: What information from our endpoints is stored in the cloud?

Please answer all of these questions ASAP as ESET support via phone call or email either doesn't respond or have any answers.

Thank you very much.

[Marcos 5,273]

1, Please contact your local ESET distributor regarding certificates.

2, ESET has servers across EU, in the USA and Japan for the respective region. Not sure what data you are referring to. If it's the LG statistics and files submitted to LiveGrid/EDTD, this data is stored in ESET HQ in Slovakia.

3, As for ESET PROTECT Cloud, various information about endpoints may be stored in the cloud, for instance, a list of files with a full path (incl. usernames in user profile paths), hashes of files, installed sw and other data collected by ESET SysInspector for instance.

In case of EDTD it's hashes of files along with their status which is stored in the cloud and shared with other computers within user's organization.

[avd 0]

Thanks for your reply, Marcos. 

For 3, where does this data reside? You mention that it may be stored in the cloud, but who's cloud? Is it partnered with a big cloud service provider(ie. AWS, Azure, GCP, etc.) or is it all owned by ESET?
 

Thanks again,

Alex

[MichalJ 434]

Hello @avd, ESET PROTECT Cloud is currently hosted in Microsoft Azure. Depending on the datacenter selection, it´s either located within US or EU datacenter locations. We do not disclose exact datacenters in use.