Your company is evaluating Creatio and this page was forwarded to you for a security review. It has two halves, because there are two parties to assess: the platform vendor, and the implementation partner who will touch your data during the project. Where a claim is Creatio’s, the source is linked. Where a commitment is ours, it says so.
Nothing here replaces the vendor’s formal documentation. Creatio’s SOC 2 report, its ISO certificate, and its cloud services agreement are available from Creatio under NDA, and we request them on your behalf as part of the fit call so your review does not wait on a sales cycle.
The platform: Creatio#
Certifications and compliance#
- ISO/IEC 27001:2013. Creatio holds an ISO/IEC 27001 certificate issued for its cloud services and software. This is the one item Creatio describes as a certificate rather than as compliance.
- SOC 2 Type II. Creatio completed a SOC 2 Type II audit against all five AICPA trust services criteria: security, availability, processing integrity, confidentiality, and privacy. The audit was first announced in January 2022; the current-period report is what your team should ask for, and it comes from Creatio under NDA.
- GDPR and HIPAA. Creatio states that it complies with GDPR and with the HIPAA security requirements, and that its data processing centres are compliant with GDPR, ISO 27001, HIPAA, SOC 1, and SOC 2. These are stated as compliance rather than as certifications held by Creatio itself.
Source: Creatio security page and the SOC 2 announcement. If your review requires a standard Creatio does not list, FedRAMP for example, treat it as absent rather than assumed.
Hosting and data residency#
Creatio Cloud runs on Amazon Web Services and Microsoft Azure. A tenant is provisioned in one region and its data stays there. The published locations are:
| Area | Locations |
|---|---|
| North America | Northern Virginia, Toronto, Washington, Mexico |
| Europe | Ireland, London, Frankfurt |
| Asia and Middle East | Jakarta, Tokyo, Israel, Dubai |
| Australia | Sydney |
Source: Creatio Cloud IP addresses and locations. Creatio also supports on-site deployment for organisations that cannot use a shared cloud; that is a different commercial and operational model and we will say so if it is the right one for you.
Identity and access#
- Single sign-on over SAML 2.0, with documented setups for Microsoft Entra ID, ADFS, and OneLogin. Any SAML 2.0 identity provider works, Okta included. For cloud tenants Creatio’s support team configures the connection.
- Two-factor authentication is native, by email, SMS, or authenticator app, with administrator-controlled enforcement and one-time recovery codes.
- Password policy controls: complexity rules, login-attempt limits, expiry.
- Access model: permissions at object, record, and column level, with role inheritance, so a support agent and a sales rep see different fields on the same account record. Operations are logged in the platform’s audit log.
Sources: Single sign-on and Two-factor authentication on Creatio Academy.
Encryption, testing, and continuity#
- Data in transit over HTTPS with TLS 1.2. Creatio states that stored data is encrypted and that passwords are salted and hashed in line with OWASP guidance.
- Regular internal and external penetration testing of the network and internet-facing software, following the OWASP Testing Guide, plus vulnerability scanning with third-party tools.
- Regular backups and archiving. Backup frequency, retention, recovery objectives, and the uptime commitment are set out in Creatio’s cloud services agreement rather than on its public pages. Ask for the agreement; it is the document your legal and IT teams will actually rely on.
Where Creatio’s public page is silent, this page is silent too. We would rather you get a precise answer from the vendor’s documentation than a confident one from us.
The project: Experceo#
This is what we do with your data between the first call and handover. These are our commitments, and they go into the statement of work.
Before anything is shared. A mutual NDA is signed before kickoff. We sign your data processing agreement and complete your vendor security questionnaire; if you do not have one, we work from a standard one. Experceo is a registered company in Turkey and our contracts say so.
Access to Salesforce. Read-only, to a sandbox or a sandbox export, never to production. Access is granted to named individuals, not to a shared account, and you revoke it at handover. We do not ask for administrator rights in your Salesforce org at any point in the proof-of-concept.
Where your data lives during the project. In your Creatio tenant, provisioned in the region you choose and owned by you from day one. Extracted data is moved from Salesforce into that tenant; working copies used for transformation and reconciliation are deleted at handover and we confirm the deletion in writing. We do not retain customer records on our systems after the project, and we do not use your data for anything other than your project.
Who sees it. The named team on the statement of work. No offshore sub-processors, no shared delivery pools. If a specialist outside the named team is needed, you approve the name first.
Our own tenant access. During the project we hold an administrator account in your Creatio tenant to build in it. At handover you reset that credential or remove the account, and the tenant’s access log shows every action taken before then.
Incidents. If we become aware of a security incident touching your data, you hear about it from us within 24 hours, with what we know, what we have done, and what we recommend.
What to send your InfoSec lead#
- This page.
- Creatio’s security page, for the platform’s own statements.
- A request through us for the current SOC 2 Type II report, the ISO 27001 certificate, and the cloud services agreement, under NDA. We put the request in on the day of the fit call.
- Your vendor security questionnaire, which we return completed before kickoff.
If the security review is the step holding up the evaluation, book 30 minutes and bring the InfoSec lead. The founder runs the call and would rather answer the hard questions early than discover them in week three.