AI Agent Automation Platforms
HappyRobot security package: can you share SOC 2 report (if available), DPA, subprocessor list, and security docs for review?
6 min read
Quick Answer: Yes. HappyRobot maintains a SOC 2 security posture, a standard Data Processing Addendum (DPA), a current subprocessor list, and additional security documentation that we share under NDA or via secure request. To access the full HappyRobot security package, contact us at security@happyrobot.ai or use the form on our website and we’ll provide the appropriate documents.
Why This Matters
If you’re evaluating HappyRobot for mission‑critical operations, you need to know that your data, your customers, and your workflows are protected before you deploy an AI workforce into production. SOC 2 reports, a clear DPA, a transparent subprocessor list, and detailed security docs are how your security, legal, and compliance teams validate that claim—not marketing copy.
Key Benefits:
- Faster security review: Having SOC 2, a standard DPA, and a current subprocessor list ready cuts weeks out of vendor risk assessments.
- Lower implementation risk: Clear security controls, access models, and fallbacks help you deploy AI workers into high‑consequence workflows with confidence.
- Stronger governance: Documented responsibilities, data flows, and auditability give you the oversight you need to scale automation without losing control.
Core Concepts & Key Points
| Concept | Definition | Why it's important |
|---|---|---|
| SOC 2 report | An independent audit report covering how HappyRobot secures, monitors, and governs systems and data against the SOC 2 Trust Services Criteria. | Gives your security team third‑party evidence that our controls are designed and operating effectively for enterprise environments. |
| Data Processing Addendum (DPA) | A contractual addendum that defines how HappyRobot processes personal data on your behalf, including roles, security measures, and GDPR alignment. | Aligns legal and compliance teams on data protection obligations, international transfers, and incident handling before you go live. |
| Subprocessor list | The documented list of infrastructure and service providers HappyRobot uses to deliver the platform (e.g., cloud, observability, communication, AI models). | Ensures you have transparency into where data may flow, who’s involved in processing, and how to align it with your internal vendor and data‑mapping requirements. |
How It Works (Step‑by‑Step)
HappyRobot is built for enterprises that treat security and governance as non‑negotiable. Here’s how the HappyRobot security package typically flows through your evaluation:
-
01 / Initial request & NDA:
Share your security review needs with us—usually via your account team or security@happyrobot.ai. If required by your org, we’ll execute a mutual NDA so we can share full SOC 2 and detailed security docs. -
02 / Security package delivery:
Once the NDA is in place (if needed), we provide a curated security package tailored to your review process. This usually includes:- SOC 2 report (or attestation details and status)
- Standard DPA for legal review
- Current subprocessor list
- Platform security overview (architecture, access controls, encryption, logging, and incident processes)
-
03 / Deep‑dive with your teams:
Your security, legal, and operations leads can then run a structured review. Our forward deployed engineers and security team join calls to walk through:- How AI workers authenticate into your systems (native integrations, APIs & webhooks, AI browser agents)
- How data is stored, logged, and audited
- How guardrails, escalation, and fallbacks work in real workflows like load tenders, check calls, and invoice follow‑ups
- How we maintain uptime and resilience in environments where missed calls or failed follow‑ups have real consequences
From there, you can finalize your DPA, confirm subprocessor alignment, and move into implementation with clear shared expectations.
Common Mistakes to Avoid
-
Treating AI platform security like “just another SaaS check‑box”:
HappyRobot sits in the flow of work—on phones, email, chat, portals, and your TMS/ERP—not on the sidelines. Don’t run a lightweight review. Involve security, legal, and operations early so your guardrails and escalation paths match your risk tolerance. -
Reviewing SOC 2 in isolation from real workflows:
A SOC 2 report tells you our controls work; it doesn’t tell you how AI workers will behave in your specific appointment scheduling, RFQ, or invoice workflows. Pair the security docs with a concrete process walk‑through so you can see how observability, escalation, and auditability play out on actual calls, emails, and system updates.
Real‑World Example
A national 3PL came to us with a hard requirement: no AI in production without a completed security and legal review. Their teams needed to know exactly how an AI workforce would handle load tenders, check calls, and invoice follow‑ups without creating new risk.
Here’s how we ran it:
- Security team: Requested our SOC 2 report, DPA, and subprocessor list, then compared them against internal security standards and data‑residency requirements. We walked them through how access works across native integrations, APIs, and browser agents, plus how logs and audit trails are stored and monitored.
- Legal & privacy: Reviewed and negotiated the DPA, focusing on roles (controller vs. processor), GDPR alignment, data retention, and breach notification timelines.
- Operations leadership: Joined a joint session to map real workflows—load tender intake, capacity confirmation, rate negotiation, appointment scheduling, and POD collection—onto our guardrail and escalation model. We showed exactly how every call, email, and portal interaction is classified, logged, and auditable.
Because the security package was ready, the review wrapped in weeks, not quarters. They moved from pilot to a 24/7 AI workforce handling track‑and‑trace and invoice follow‑ups with full security sign‑off and an audit‑ready paper trail.
Pro Tip: When you request HappyRobot’s security package, bring a short list of the exact workflows you plan to automate (e.g., “check calls + appointment scheduling + invoice follow‑ups”)—we can align SOC 2 controls, DPA clauses, and subprocessor usage to those flows so your review is faster and more grounded in reality.
Summary
HappyRobot is built for enterprises where operations are complex, exceptions are constant, and there are real consequences when something goes wrong. That’s why we back our AI workforce with SOC 2 controls, a clear DPA, transparent subprocessor documentation, and observable, explainable workflows—not a black box.
If your security and legal teams need to review our SOC 2 report (where available), DPA, subprocessor list, and platform security docs, we’re ready to share them under the right protections and walk through how they map to your real‑world freight, logistics, and industrial operations.