Welcome to the Timus Networks Trust Center

At Timus Networks, security, compliance, and transparency are at the core of our business. Our platform is designed to provide Zero Trust Network Access (ZTNA), Secure Access Service Edge (SASE), and advanced cybersecurity solutions to protect your data and ensure regulatory compliance. This Trust Center provides resources on our security practices, compliance certifications, and operational policies.

If you have any questions check out our FAQ at the bottom of the page or contact [email protected]

For system status please visit status.timusnetworks.com

Compliance

SOC 2 Type II
ISO Certification
GDPR Compliance
CMMC Alignment

Resources

Reports

  • SOC2 Type II Report
  • ISO 27001 Certificate
  • Cybersecurity Insurance Certificate

Controls

Infrastructure Security
  • Remote Access MFA Enforced
  • Remote Access Encryption
Product Security
  • Control Self-Assessments Conducted
  • Penetration Testing
Organizational Security
  • Portable Media Encrypted
  • Anti-Malware Technology Utilized
Internal Security Procedures
  • Business Continuity & Disaster Recovery Plan
  • Incident Response Plan

Data Collected

  • User & Account Data: SOC2 Type II Report
  • Network & Secruity Data: GDPR Compliance Statement
  • Service Usage Data: Information Security Policy
  • Timus Does Not Collect: Personal content data (e.g., emails, messages, file contents)

Subprocessors

Oracle Cloud Infrastructure (OCI)
(Primary Cloud Infrastructure Provider)
USA & EU
Cloudflare
(DDoS protection and CDN)
USA

FAQ

Do you train AI models on customer data?

No, Timus does not use customer data to train AI models.

Is data encrypted in transit and at rest?

Yes, all customer data is encrypted using industry-standard encryption protocols both in transit and at rest.

Where is customer data stored?

Data is stored in secure cloud environments, primarily within Oracle Cloud Platform & AWS (USA data centers, depending on customer requirements).

How long do you retain customer data?

Customer data is retained as per our Data Retention Policy. Upon request or termination, customer data is deleted securely.

Other Resources

  • W-9 Form

Policies

  • Terms of Service
  • Privacy Policy
  • Data Retention and Deletion Policy
  • Disaster Recovery & Business Continuity Plan
  • Incident Response Policy
  • Information Security Policy

Reports

  • Cybersecurity Insurance Certificate
  • ISO 27001 Certificate
  • SOC2 Type II Report

Infrastructure Security

    Control

    Status

  • Remote access MFA enforced

    The company’s production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.

    Active
  • Remote access encrypted enforced

    The company’s production systems can only be remotely accessed by authorized employees via an approved encrypted connection.

    Active
  • Network segmentation implemented

    The company’s network is segmented to prevent unauthorized access to customer data.

    Active

Internal Security Procedures

    Control

    Status

  • Continuity and disaster recovery plans tested

    The company has a documented business continuity/disaster recovery (BC/DR) plan and tests it at least annually.

    Active
  • Cybersecurity insurance maintained

    The company maintains cybersecurity insurance to mitigate the financial impact of business disruptions.

    Active
  • Whistleblower policy established

    The company has established a formalized whistleblower policy, and an anonymous communication channel is in place for users to report potential issues or fraud concerns.

    Active

Organizational Security

    Control

    Status

  • Portable media encrypted

    The company encrypts portable and removable media devices when used.

    Active
  • Confidentiality Agreement acknowledged by contractors

    The company requires contractors to sign a confidentiality agreement at the time of engagement.

    Active
  • Confidentiality Agreement acknowledged by employees

    The company requires employees to sign a confidentiality agreement during onboarding.

    Active

Product Security

    Control

    Status

  • Control self-assessments conducted

    The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are taken based on relevant findings. If the company has committed to an SLA for a finding, the corrective action is completed within that SLA.

    Active
  • Penetration testing performed

    The company’s penetration testing is performed at least annually by certified third-party providers. A remediation plan is developed, and changes are implemented to remediate vulnerabilities in accordance with SLAs.

    Active

Data Collected

    Data

    Status

  • User & Account Data

    Name, Email, and Organization Details (For account creation and authentication)
    Role & Permissions (To manage user access levels within the platform)

    Active
  • Network & Security Data

    IP Address & Device Information (For security logging, anomaly detection, and Zero Trust access verification)
    Access Logs & Session Data (For security monitoring and compliance auditing purposes)
    Multi-Factor Authentication (MFA) Status (To enforce secure authentication policies)

    Active
  • Service Usage Data

    Connection Requests & Usage Analytics (To improve security posture and optimize network routing)
    Threat Intelligence & Anomaly Detection (For proactive security protection and incident response)

    Active
  • Timus Does Not Collect

    Personal content data (e.g., emails, messages, file contents)
    Customer-stored business data
    Audio or video recordings

    Inactive

Subprocessors

  • Oracle Cloud Infrastructure (OCI)

    (Primary Cloud Infrastructure Provider)

    USA & EU

  • Cloudflare

    (DDoS protection and CDN)

    USA

  • Zendesk

    (Customer Support)

    USA

  • HubSpot

    (CRM & Marketing)

    USA

  • Stripe

    (Payment Processing)

    USA

  • Open AI

    USA

CMMC Alignment

  • Timus Networks supports partners operating in U.S. federal and defense supply chains by aligning with selected CMMC 2.0 Level 2 security domains.

    Timus provides Zero Trust Network Access, logging, monitoring, and secure communication controls mapped to CMMC requirements.

    Full CMMC compliance remains shared between Timus and the customer.


    Shared Responsibility Warning

    Important: Timus is a contributing security service and does not independently fulfill full CMMC certification requirements.

    Customers remain responsible for endpoint security, user governance, internal policies, and audit evidence.

CMMC Domain Acronym Glossary

    • AC – Access Control
    • AU – Audit and Accountability
    • CM – Configuration Management
    • IA – Identification and Authentication
    • IR – Incident Response
    • CA – Security Assessment (Assessment, Authorization & Monitoring)
    • SC – System & Communications Protection
    • SI – System & Information Integrity

1. Access Control (AC)

  • Requirement Timus Customer Shared
    AC-1 Remote Access Control
    • Zero-Trust access enforcement
    • Secure client access
    • Device configuration
    • Policy alignment
    AC-2 Account Management
    • RBAC
    • Provision users
    • Governance
    AC-3 Access Enforcement
    • MFA
    • Local access rules
    • Zero-Trust policies
    AC-4 Session Control
    • Secure session handling
    • Local timeout rules
    • Monitoring

2. Audit & Accountability (AU)

  • Requirement Timus Customer Shared
    AU-1 Logging
    • Connection & access logging
    • Endpoint / OS logging
    • SIEM integration
    AU-2 Retention
    • Retains data per policy
    • Export logs if longer retention is required
    • Audit evidence
    AU-3 Review
    • Zero-Trust analytics
    • Review internal logs
    • Incident investigation

3. Configuration Management (CM)

  • Requirement Timus Customer Shared
    CM-1 Baseline
    • Hardened platform baseline
    • System configuration
    • Exceptions
    CM-2 Change Control
    • Product updates
    • Local firewall changes
    • Coordination

4. Identification & Authentication (IA)

  • Requirement Timus Customer Shared
    IA-1 Identification
    • MFA enforced
    • Strong authentication
    • Policy enforcement
    IA-2 Credential Management
    • Password policy
    • SSO & IdP configuration
    • Federation

5. Incident Response (IR)

  • Requirement Timus Customer Shared
    IR-1 Reporting
    • Platform security response
    • Report misuse/breach
    • Joint communication
    IR-2 Handling
    • Platform incident procedures
    • Internal IR plan
    • Escalation

6. Security Assessment (CA)

  • (also referenced as Assessment, Authorization & Monitoring)


    Requirement Timus Customer Shared
    CA-1 Assessment Policy
    • Third-party penetration testing
    • Internal compliance program
    • Evidence sharing
    CA-2 Security Assessment
    • Platform-level assessment
    • Internal systems
    • Audit reporting
    CA-3 Continuous Monitoring
    • Anomaly monitoring
    • Network monitoring
    • Notifications & escalation

7. System & Communications Protection (SC)

  • Requirement Timus Customer Shared
    SC-1 Encryption
    • Secure encrypted tunnels
    • Endpoint config
    • Enforcement
    SC-2 Boundary Protection
    • Zero-Trust access
    • Endpoint protection
    • Monitoring

8. System & Information Integrity (SI)

  • Requirement Timus Customer Shared
    SI-1 Monitoring
    • Threat detection
    • Antivirus/EDR
    • Alerts
    SI-2 Patch Management
    • Platform updates
    • OS/device patching
    • SLA coordination

Contact info

FAQs

  • How can I report a security issue?

    +

    If you believe you have identified a security vulnerability, please report it to [email protected].

  • Do you support CMMC?

    +

    Yes — Timus aligns with selected practices in CMMC 2.0 Level 2 and provides technical controls that support federal compliance requirements.

    Timus enables Zero Trust access, secure remote connectivity, encrypted communications, logging, and monitoring mapped to CMMC security domains.

    Full CMMC compliance is shared — customers must implement internal security policies, endpoint protections, and governance requirements.

  • What happens to my data if I delete my account?

    +

    When you delete your account, your data enters a 30-day redemption period during which it is retained solely for legal, regulatory, or compliance purposes. After this period, the data is permanently deleted and cannot be recovered. During the redemption period, your data is not used for any operational or business activities.

  • Can we sign a Mutual Non-disclosure Agreement?

    +

    Our privacy policy should cover most users' confidentiality requirements, but if you still need an MNDA please use our MNDA request form

  • How long do you retain customer data?

    +

    Customer data is retained as per our Data Retention Policy. Upon request or termination, customer data is deleted securely.

  • Where is customer data stored?

    +

    Data is stored in secure cloud environments, primarily within Oracle Cloud Platform & Amazon Web Services.

  • Is data encrypted in transit and at rest?

    +

    Yes, all customer data is encrypted using industry-standard encryption protocols both in transit and at rest.

  • Do you train AI models on customer data?

    +

    No, Timus does not use customer data to train AI models.