How We Protect Your Data and Your Business

eXpand AD adheres to the General Data Protection Regulation for all clients and contacts in the European Union and European Economic Area. We implement data minimization, lawful basis documentation, subject access request handling, and data processing agreements with all sub-processors.

Our infrastructure and operational controls have been independently audited against the AICPA Trust Services Criteria. The SOC 2 Type II report covers security, availability, and confidentiality over a continuous observation period, confirming that our controls operate effectively over time, not just at a point in time.

We are certified to ISO/IEC 27001, the international standard for information security management systems. This means our risk treatment plan, asset inventory, access controls, incident response procedures, and business continuity planning have all been independently verified by an accredited certification body.

The Texas Risk and Authorization Management Program (TX-RAMP) is the state of Texas's framework for assessing and authorizing cloud services used by Texas state agencies. Our TX-RAMP certification confirms that our security posture meets the standards required to serve Texas government and public sector clients.

eXpand AD complies with the California Consumer Privacy Act, giving California residents the right to know what personal data we collect, request deletion, and opt out of data sales. We do not sell personal information. Privacy requests are honored within the statutory 45-day window.

eXpand AD complies with Canada's Personal Information Protection and Electronic Documents Act (PIPEDA), giving Canadian residents rights over their personal information, including access, correction, withdrawal of consent, and complaints to the Office of the Privacy Commissioner of Canada.