Company: DOMO
Filing Date: 2025-04-04
Form Type: 10-K
Source: 0001505952-25-000045
Chunk: 30

Company: DOMO, INC.
Filing Date: 2025-04-04
Form: 10-K
Item: Item 1
Chunk 30
---
 be certain which laws will be deemed applicable to us given the global nature of our business, including with respect to such topics as data privacy and security, pricing, advertising, taxation, content regulation, and intellectual property ownership and infringement or other violations of intellectual property rights. In particular, the various privacy, data protection and data security legal obligations that apply to us may evolve in a manner that relates to our practices or the features of our applications or platform, and we may need to take additional measures to comply with such changes in legal obligations and to maintain and improve our information security posture in an effort to avoid information security incidents or breaches affecting personal data or other sensitive or proprietary information.

21

Data Security  

Domo is designed to meet enterprise security, compliance and privacy requirements of our customers, particularly in highly regulated industries, such as financial services, health care, pharmaceuticals, energy and technology. Our architecture is designed to allow customers to maintain control of their data through various means including: multiple logical and physical security layers; least privilege and separation of duties access model; threat assessments of each new feature; transport layer encryption and encryption at rest that allows customers to manage their own encryption keys using Domo’s Bring Your Own Key, or BYOK; several self-service security controls offered within the Domo platform for customers to implement their own security policies, and extensive logging and monitoring of network, system and application events.

We voluntarily engage independent third-party security auditors to test our systems and controls at least annually against several widely recognized security standards and regulations. 

We have completed a SOC 1 and SOC 2, and HITRUST risk-based attestation. Service Organization Controls, or SOC, are standards established by the American Institute of Certified Public Accountants for reporting on internal control environments implemented within an organization. We have also been certified as compliant with ISO 27001 and ISO 27018 standards. The ISO 27001 security standard specifies the requirements for establishing, implementing, operating, monitoring, reviewing, maintaining and improving a documented Information Security Management System within the context of the organization’s overall business risks. This standard addresses confidentiality, access control, vulnerability and risk assessment. ISO 27018 establishes commonly accepted control objectives, controls and guidelines for implementing measures to protect personally identifiable information in accordance with the privacy principles in ISO/IEC 29100 for a cloud computing environment. Furthermore, we have completed our annual third party validation of HIPAA Security and Privacy Risk Analysis.  We sign business associate agreements with our customers who require them in support of compliance with the