Hi all, I guess there are Pulumi team members here from whom we would like to get some support. We sent this support e-mail last week but still didn’t get a response, and we need to make a decision until Tomorrow. So if anyone can take a look at this we would appreciate it. You can respond to this email: d.dimitric@levi9.com Thanks!

Hello,

We are currently qualifying Pulumi as our Infrastrucutre management tool, but we have some Information security concerns that we'd like to clear up.

Our product is classified as a *Medical device* and therefore needs to conform to a high security standard, especially regarding PII.

We saw this section on your website, and we would like to have a bit more information about it:

> The Pulumi Service is reliable, secure, and has undergone multiple audits, including SOC2 and professional pen-testing. Because of the client/server division of responsibilities — notably that the server doesn't have direct access to your cloud credentials, runtime data, or PII — the Pulumi Service has been used in organizations with advanced compliance needs, including PCI, ISO 27001, HIPAA, and more. If you'd like to discuss any of these topics, please contact us.

(copied from <https://www.pulumi.com/docs/intro/concepts/state/>)

The T&C (<https://www.pulumi.com/terms-and-conditions/>) and PP (<https://www.pulumi.com/privacy/>) pages on your website didn't provide enough information, so we would just like to clear some things up:

1. Can you provide any evidence about information security? What do you have in place to make sure our data is safe? There is no written policy on the website.
2. Can you provide more details about the your SOC2 certification?
3. Exactly what kind of data does Pulumi have access to? Be very specific please.
4. What is the operational impact of Pulumi being unavailable?

Our product currently operates in EU, and it will be available in the US, as well as Globally.

These are the standards we currently implement (and possibly there will be more):
- ISO 13485
- ISO/IEC 27001
- NEN 7510

Thanks in advance,
SkinVision Team

3. and 4. are kinda easy to answer. 3. - everything that is part of a Stack config + Stack State. 4. You are not able to deploy or destroy resources PS pulumi provides a Secret service to encrypt secrets, you can use your own KMS to encrypt those secrets and then Pulumi will only ever see the hashes

Thanks, no. 1 is kind of the main point for the company

yeah I'd be really curious about 1. and 2. myself!

We used the contact form I think, will forward the mail to

sales

as well, thanks! I’ll post their response here

@rough-intern-34947 Sorry about missing the original inquiry, but we did receive the request sent to

sales@

and will follow up.

Thanks @witty-candle-66007 !