Security and data processing
Boon holds an unqualified SOC 2 Type II attestation covering the Security trust services category for April 1 to June 30, 2026. Customer data is hosted in the United States, encrypted with TLS 1.2 or higher in transit and AES-256 at rest, and isolated per customer with row-level access controls. A data processing agreement is available from security@boon-health.com.
Does Boon have a SOC 2 Type II report?
Boon received an unqualified SOC 2 Type II attestation from Zero Day CPA, PC. The report covers the Security trust services category only for the period April 1, 2026 through June 30, 2026. Availability, Processing Integrity, Confidentiality, and Privacy are not in scope.
The report is not public. Prospects can request it at security@boon-health.com.
How is customer data protected?
- In transit: TLS 1.2 or higher, with HTTP Strict Transport Security (HSTS) enforced.
- At rest: AES-256 encryption. Backups are encrypted to the same standard, and database backups run daily.
- Isolation: row-level access controls scope every query to the customer organization.
- Roles: access is segmented by role (employee, coach, administrator, program manager).
- Staff access: Boon team access to production requires multi-factor authentication.
How do people sign in to Boon?
- Program admins sign in with Google, or with email and password plus a one-time code.
- Employees sign in with a one-time link sent to their work email.
- SAML SSO and SCIM are not currently available.
Where is data hosted, and who processes it?
Customer data is hosted in the United States. Some participant surveys run through Typeform in the EU. The full sub-processor list, with what each one does and where it runs, is on the Boon for enterprise page. Boon gives 30 days' advance notice of sub-processor changes, with 15 days to object.
How are breaches, deletion, and privacy rights handled?
- Breach notification: affected customers are notified within 72 hours of Boon becoming aware of a personal data breach.
- Deletion: customer data is returned or deleted within 90 days of termination, subject to legal obligations.
- Privacy rights: California residents have rights under the CCPA and CPRA. Boon does not sell personal information.
To request the data processing agreement, email security@boon-health.com.
Frequently asked questions
Is Boon SOC 2 compliant?
Boon received an unqualified SOC 2 Type II attestation from Zero Day CPA, PC, covering the Security trust services category only for April 1, 2026 through June 30, 2026. The report is not public and is available on request at security@boon-health.com.
Does Boon support SAML SSO or SCIM?
No. SAML single sign-on and SCIM user provisioning are not currently available. Program admins can sign in with Google, and employees sign in with a one-time email link.
Where is Boon customer data stored?
Customer data is hosted in the United States. Some participant surveys run through Typeform in the EU.
How do we get a DPA from Boon?
Email security@boon-health.com for the data processing agreement, the SOC 2 Type II report, or help with a security questionnaire.
What happens to our data when the contract ends?
Customer data is returned or deleted within 90 days of termination, subject to legal obligations.
Does Boon sell personal information?
No. Boon does not sell personal information. California residents have rights under the CCPA and CPRA, described in the privacy policy.
Related
For the SOC 2 report or a security questionnaire, email security@boon-health.com.