This article is for prospects, current customers, and past customers who need access to Gusto’s SOC reports and bridge letters. You get them through our Security Trust Center at gusto.com/security, after you sign a Non-Disclosure Agreement (NDA).
A System and Organization Controls (SOC) report helps verify that a company follows important rules to keep data safe, private, and available. Independent third-party auditors create these reports to help customers and partners check for risks when working with a company.
Our reports focus on security, availability, and confidentiality.
Expand the sections to learn more. Use CMD + F (or CTRL + F) to search for words in the article.
Gusto’s Security Trust Center is the Security at Gusto page on our website. It explains how we protect your data, and it’s where you go to get our security documents, like SOC reports and bridge letters.
To find the Security Trust Center, follow these steps:
Go to gusto.com/security in a web browser. You can also go to trust.gusto.com, which opens the same page.
Near the top of the page, select a topic to jump to it: Data security, Application security, Product security, People security, or Information security.
To get our SOC 1 or SOC 2 reports and bridge letters, select Information security, then open the SOC dropdown. Then follow the steps in Request an SOC 1 or SOC 2 report and a bridge letter.
On the same page, you can also:
Find our HIPAA guidelines. Select Information security, then open the HIPAA dropdown.
Report a security vulnerability. Select Jump to our Bug Bounty program at the top of the page.
We support the following reports for prospects, current customers, and past customers:
SOC 1: Checks internal financial processing
SOC 2: Focuses on IT, privacy, and technology
SSAE-18: Enhancements to improve the SOC reports
Bridge (gap) letters: Cover the time between the end of our last SOC report audit period and the date on the letter
You’ll need to sign a Non-Disclosure Agreement (NDA) before you can download the reports.
You request our SOC reports and bridge letters through Gusto’s Security Trust Center. Our bridge letters are in the same folder as our SOC reports, so these steps get you both.
Before you download our security reports, you must sign a Non-Disclosure Agreement (NDA). We use a self-service workflow so you can sign the NDA and then access the reports.
How to sign the NDA and get our security reports:
Go to our Security Trust Center at https://gusto.com/security.
Scroll to Information security, then open the SOC dropdown.
Click the link to our Ironclad NDA form (hosted at ironcladapp.com).
On the form, enter:
Full legal name of your business
Full name of the person signing for your business
Email address of the signer
Job title of the signer
Click Submit. Our system automatically creates the NDA and refreshes the page.
Click Click to sign, then complete the signature steps.
After you sign, you see a “You’re All Set!” message. Click Download it now to save a copy of the signed NDA.
After the NDA is signed, we send an automatic email from “Gusto via Ironclad” via Security-GRC to the email address you entered in the NDA form.
Open that email (check spam if needed) and click the link in the message body. A new browser tab opens with a folder that contains our security certification reports and bridge letters.
View or download any report you need from that folder.
Did not get the email, or need a bridge letter that covers a later date? Each bridge letter covers the time up to the date on the letter, and we add newer letters to the folder over time. Check the folder for the newest one first. If you still cannot find what you need, contact us.