Request documents

Ask us for the evidence

We do not host our reports as downloads. Audit reports, questionnaires and certificates are sent by email to a named person, so that we know who holds them and can tell you if something changes. Ask and we will send them.

Loading the request form…

What happens next

We read it, a person not a queueRequests go to the team that owns these documents. You will hear back within one business day, including if the answer is that we cannot share something.
An NDA where one is neededThe SOC 2 report, the penetration test summary and the ISO Statement of Applicability go out under a mutual NDA. If we already have one with you, we will use it; if not, we will send ours, and we are happy to sign yours.
Sent to you by emailDocuments arrive as attachments addressed to you. We keep a record of who holds a copy of each report so that we can tell you when a new one is issued or something material changes.

Some of it you already have

The control list, the subprocessor list and our policies are published on this site and need no request at all. Check the index before you wait on us.

See what is available

Reporting a vulnerability instead? privacy@harmony.io reaches the same team, and our disclosure policy sets out what to expect.