At Timus Networks, security, compliance, and transparency are at the core of our business. Our platform is designed to provide Zero Trust Network Access (ZTNA), Secure Access Service Edge (SASE), and advanced cybersecurity solutions to protect your data and ensure regulatory compliance. This Trust Center provides resources on our security practices, compliance certifications, and operational policies.
Welcome to the Timus Networks Trust Center
If you have any questions check out our FAQ at the bottom of the page or contact [email protected]
For system status please visit status.timusnetworks.com
Compliance
Resources
Reports
- SOC2 Type II Report
- ISO 27001 Certificate
- Cybersecurity Insurance Certificate
Controls
- Remote Access MFA Enforced
- Remote Access Encryption
- Control Self-Assessments Conducted
- Penetration Testing
- Portable Media Encrypted
- Anti-Malware Technology Utilized
- Business Continuity & Disaster Recovery Plan
- Incident Response Plan
Data Collected
- User & Account Data: SOC2 Type II Report
- Network & Secruity Data: GDPR Compliance Statement
- Service Usage Data: Information Security Policy
- Timus Does Not Collect: Personal content data (e.g., emails, messages, file contents)
Subprocessors

(Primary Cloud Infrastructure Provider)

(DDoS protection and CDN)
FAQ
Do you train AI models on customer data?
No, Timus does not use customer data to train AI models.
Is data encrypted in transit and at rest?
Yes, all customer data is encrypted using industry-standard encryption protocols both in transit and at rest.
Where is customer data stored?
Data is stored in secure cloud environments, primarily within Oracle Cloud Platform & AWS (USA data centers, depending on customer requirements).
How long do you retain customer data?
Customer data is retained as per our Data Retention Policy. Upon request or termination, customer data is deleted securely.
Resources
Other Resources
-
W-9 Form
Policies
-
Terms of Service
-
Privacy Policy
-
Data Retention and Deletion Policy
-
Disaster Recovery & Business Continuity Plan
-
Incident Response Policy
-
Information Security Policy
Reports
-
Cybersecurity Insurance Certificate
-
ISO 27001 Certificate
-
SOC2 Type II Report
Controls
Infrastructure Security
-
Remote access MFA enforced
The company’s production systems can only be remotely accessed by authorized employees possessing a valid multi-factor authentication (MFA) method.
-
Remote access encrypted enforced
The company’s production systems can only be remotely accessed by authorized employees via an approved encrypted connection.
-
Network segmentation implemented
The company’s network is segmented to prevent unauthorized access to customer data.
Control
Status
Internal Security Procedures
-
Continuity and disaster recovery plans tested
The company has a documented business continuity/disaster recovery (BC/DR) plan and tests it at least annually.
-
Cybersecurity insurance maintained
The company maintains cybersecurity insurance to mitigate the financial impact of business disruptions.
-
Whistleblower policy established
The company has established a formalized whistleblower policy, and an anonymous communication channel is in place for users to report potential issues or fraud concerns.
Control
Status
Organizational Security
-
Portable media encrypted
The company encrypts portable and removable media devices when used.
-
Confidentiality Agreement acknowledged by contractors
The company requires contractors to sign a confidentiality agreement at the time of engagement.
-
Confidentiality Agreement acknowledged by employees
The company requires employees to sign a confidentiality agreement during onboarding.
Control
Status
Product Security
-
Control self-assessments conducted
The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are taken based on relevant findings. If the company has committed to an SLA for a finding, the corrective action is completed within that SLA.
-
Penetration testing performed
The company’s penetration testing is performed at least annually by certified third-party providers. A remediation plan is developed, and changes are implemented to remediate vulnerabilities in accordance with SLAs.
Control
Status
Data Collected
-
User & Account Data
Name, Email, and Organization Details (For account creation and authentication)
Role & Permissions (To manage user access levels within the platform)
-
Network & Security Data
IP Address & Device Information (For security logging, anomaly detection, and Zero Trust access verification)
Access Logs & Session Data (For security monitoring and compliance auditing purposes)
Multi-Factor Authentication (MFA) Status (To enforce secure authentication policies)
-
Service Usage Data
Connection Requests & Usage Analytics (To improve security posture and optimize network routing)
Threat Intelligence & Anomaly Detection (For proactive security protection and incident response)
-
Timus Does Not Collect
Personal content data (e.g., emails, messages, file contents)
Customer-stored business data
Audio or video recordings
Data
Status
Subprocessors
-
Oracle Cloud Infrastructure (OCI)(Primary Cloud Infrastructure Provider)
USA & EU
-
Cloudflare(DDoS protection and CDN)
USA
-
Zendesk(Customer Support)
USA
-
HubSpot(CRM & Marketing)
USA
-
Stripe(Payment Processing)
USA
-
Open AI
USA
CMMC Alignment
-
Timus Networks supports partners operating in U.S. federal and defense supply chains by aligning with selected CMMC 2.0 Level 2 security domains.
Timus provides Zero Trust Network Access, logging, monitoring, and secure communication controls mapped to CMMC requirements.
Full CMMC compliance remains shared between Timus and the customer.
Shared Responsibility Warning
Important: Timus is a contributing security service and does not independently fulfill full CMMC certification requirements.
Customers remain responsible for endpoint security, user governance, internal policies, and audit evidence.
CMMC Domain Acronym Glossary
-
- AC – Access Control
- AU – Audit and Accountability
- CM – Configuration Management
- IA – Identification and Authentication
- IR – Incident Response
- CA – Security Assessment (Assessment, Authorization & Monitoring)
- SC – System & Communications Protection
- SI – System & Information Integrity
1. Access Control (AC)
-
Requirement Timus Customer Shared AC-1 Remote Access Control - Zero-Trust access enforcement
- Secure client access
- Device configuration
- Policy alignment
AC-2 Account Management - RBAC
- Provision users
- Governance
AC-3 Access Enforcement - MFA
- Local access rules
- Zero-Trust policies
AC-4 Session Control - Secure session handling
- Local timeout rules
- Monitoring
2. Audit & Accountability (AU)
-
Requirement Timus Customer Shared AU-1 Logging - Connection & access logging
- Endpoint / OS logging
- SIEM integration
AU-2 Retention - Retains data per policy
- Export logs if longer retention is required
- Audit evidence
AU-3 Review - Zero-Trust analytics
- Review internal logs
- Incident investigation
3. Configuration Management (CM)
-
Requirement Timus Customer Shared CM-1 Baseline - Hardened platform baseline
- System configuration
- Exceptions
CM-2 Change Control - Product updates
- Local firewall changes
- Coordination
4. Identification & Authentication (IA)
-
Requirement Timus Customer Shared IA-1 Identification - MFA enforced
- Strong authentication
- Policy enforcement
IA-2 Credential Management - Password policy
- SSO & IdP configuration
- Federation
5. Incident Response (IR)
-
Requirement Timus Customer Shared IR-1 Reporting - Platform security response
- Report misuse/breach
- Joint communication
IR-2 Handling - Platform incident procedures
- Internal IR plan
- Escalation
6. Security Assessment (CA)
-
(also referenced as Assessment, Authorization & Monitoring)
Requirement Timus Customer Shared CA-1 Assessment Policy - Third-party penetration testing
- Internal compliance program
- Evidence sharing
CA-2 Security Assessment - Platform-level assessment
- Internal systems
- Audit reporting
CA-3 Continuous Monitoring - Anomaly monitoring
- Network monitoring
- Notifications & escalation
7. System & Communications Protection (SC)
-
Requirement Timus Customer Shared SC-1 Encryption - Secure encrypted tunnels
- Endpoint config
- Enforcement
SC-2 Boundary Protection - Zero-Trust access
- Endpoint protection
- Monitoring
8. System & Information Integrity (SI)
-
Requirement Timus Customer Shared SI-1 Monitoring - Threat detection
- Antivirus/EDR
- Alerts
SI-2 Patch Management - Platform updates
- OS/device patching
- SLA coordination
Contact info
-
For additional information, contact [email protected].
FAQs
-
How can I report a security issue?
If you believe you have identified a security vulnerability, please report it to [email protected].
-
Do you support CMMC?
Yes — Timus aligns with selected practices in CMMC 2.0 Level 2 and provides technical controls that support federal compliance requirements.
Timus enables Zero Trust access, secure remote connectivity, encrypted communications, logging, and monitoring mapped to CMMC security domains.
Full CMMC compliance is shared — customers must implement internal security policies, endpoint protections, and governance requirements.
-
What happens to my data if I delete my account?
When you delete your account, your data enters a 30-day redemption period during which it is retained solely for legal, regulatory, or compliance purposes. After this period, the data is permanently deleted and cannot be recovered. During the redemption period, your data is not used for any operational or business activities.
-
Can we sign a Mutual Non-disclosure Agreement?
Our privacy policy should cover most users' confidentiality requirements, but if you still need an MNDA please use our MNDA request form
-
How long do you retain customer data?
Customer data is retained as per our Data Retention Policy. Upon request or termination, customer data is deleted securely.
-
Where is customer data stored?
Data is stored in secure cloud environments, primarily within Oracle Cloud Platform & Amazon Web Services.
-
Is data encrypted in transit and at rest?
Yes, all customer data is encrypted using industry-standard encryption protocols both in transit and at rest.
-
Do you train AI models on customer data?
No, Timus does not use customer data to train AI models.