Human Made Review for Regulated Industries Needing SOC 2 Compliance

The research in brief

Human Made is a strong fit for a regulated-industry buyer whose vendor security review specifically requires SOC 2 evidence from an enterprise managed WordPress host, provided the buyer can support an enterprise budget and will verify the actual audit report before signing. Two of the seven platforms in this study named Human Made during the ranking stage - Google (rank 5) and Kimi (rank 4) - giving it an average listed rank of 4.5 and a 28.6% share of included platform responses. The strongest reason to consider it is publicly stated SOC 2 Type II coverage for both Human Made and its Altis Cloud platform, backed by documented audit logging, MFA, SSO, and log-shipping controls. The main limitation is that the SOC 2 report itself, its scope, auditor, audit period, and exceptions are not public, and pricing starts at $24,000 per year.

Research Snapshot

Why Human Made Qualified for This Study

Questions explored

• Why did only two of seven AI platforms name Human Made for SOC 2 compliance hosting?
• Is Human Made a qualified candidate for a regulated-industry vendor security review?

Human Made qualified because it cleared the study's minimum-mentions threshold and because its compliance posture is directly relevant to the research prompt. The study required a provider to be named by at least two platforms during ranking discovery; Human Made was named by Google and Kimi, which placed it at ranks 5 and 4 respectively ^[16].

Qualification is not the same as consensus. Five of the seven platforms evaluated Human Made's fit during the fit-research stage but did not name it in their ranking lists, so the 28.6% platform share reflects ranking-stage discovery only, not total platform coverage. The deterministic identity audit also flagged that official-site retrieval failed for Human Made's homepage and that an exact-name fallback was used to establish identity, meaning the domain identity and contracting entity should be confirmed during procurement.

The hosting offering in focus

Questions explored

• Which Human Made product or plan should a regulated buyer evaluate for SOC 2 compliance hosting?
• Is Altis Cloud the same thing as Human Made managed WordPress hosting?

The relevant offering is Altis Cloud, including Altis Enterprise Cloud for WordPress with Human Made managed WordPress services. Every platform in this study converged on that same product identification, though the naming varies slightly across responses.

Human Made positions Altis as a separate enterprise WordPress hosting product built by the Human Made team, with pricing starting from around $24,000 per year and based on page views ^[11]. Altis Cloud is the hosting platform; Human Made is the agency and managed-services layer. That distinction matters for a vendor review because the SOC 2 scope may cover one, both, or a subset of the combined service.

The certification claim itself appears on company-controlled material. Human Made states that Human Made and Altis Cloud are SOC 2 Type II certified ^[15], and Altis separately states that its SOC 2 Type II report provides independent validation of controls designed and operating over time ^[27]. Grok reported that the certification was achieved in July 2025 and covers security, availability, processing integrity, confidentiality, and privacy ^[17]. That trust-criteria detail comes from a single platform and should be treated as platform-reported until the report is reviewed.

What the AI Platforms Agreed About

Questions explored

• What do AI platforms agree on about Human Made's SOC 2 compliance hosting?
• Does Human Made have SOC 2 Type II certification for managed WordPress hosting?

The clearest area of agreement is the existence of a SOC 2 Type II claim. All seven platforms that produced fit research referenced SOC 2 certification for Human Made, Altis Cloud, or both, and the underlying company announcement is cited across OpenAI, Anthropic, Perplexity, Google, and Grok responses ^[15].

Platforms also agreed on the security control set. Altis Cloud publicly lists password-policy configuration, multi-factor authentication, single sign-on, and audit logging as standard security and compliance tools ^[20]. Documentation describes MFA, password strength rules, and audit logging as compliance-supporting features ^[4], and the platform documents historical change records and user deactivation while retaining content ^[9].

Agreement extended to infrastructure. Altis is built on AWS and offers multiple origin regions ^[19], and platforms noted that AWS itself maintains SOC 2, ISO 27001, and ISO 27017 certifications ^[31]. An independent G-Cloud listing corroborates the security posture, describing separate assets storage, WAF, encryption, HSTS, integrated disaster recovery, and data centers certified to SOC 2/ISO standards ^[29].

Logging and auditability drew consistent support. Altis documents PHP, Nginx, cron, email, and access logs ^[6]. Its audit-log feature uses append-only cloud storage and retains entries indefinitely by default ^[2]. Log shipping to a customer-owned S3 bucket supports external retention but is not enabled by default and leaves lifecycle costs to the customer ^[7].

Where the AI Platforms Disagreed or Were Uncertain

Questions explored

• What is unverified about Human Made's SOC 2 certification scope and audit details?
• Do AI platforms disagree about whether Human Made is a good SOC 2 hosting choice?

Fit ratings diverged materially. OpenAI and Google rated Human Made a strong fit; Anthropic, Grok, and Perplexity rated it good; DeepSeek rated it mixed; Kimi rated it uncertain. That spread reflects different weightings of the same evidence rather than contradictory facts.

The most consequential uncertainty is report scope. Public materials do not show the SOC 2 report itself or identify the auditor, audit period, trust-service criteria, or exceptions ^[15]. Kimi reported that no independent or public verification of Human Made SOC 2 details was found in search ^[10], and DeepSeek characterized the certification as a company claim with no independent audit registry or third-party confirmation located ^[13].

There is also an internal inconsistency in the company's own materials. Human Made's page says both Human Made and Altis Cloud are SOC 2 Type II certified, while older Altis materials describe the certification as belonging to Altis; the precise legal entity and service scope should be confirmed in the report ^[15]. Kimi additionally flagged that whether the attestation is Type I or Type II is unclear from company materials, and that the relationship between Altis Cloud and Altis DXP compliance boundaries is unclear ^[12].

Questionnaire support is unresolved. The Altis pricing page states that custom compliance testing or reports can be supported and that advanced audit logging and egress gateways are available, but public documentation does not establish a guaranteed security-questionnaire SLA, standard evidence package, right-to-audit terms, or automatic provision of the SOC 2 report ^[20]. Anthropic found no explicit documentation confirming a formal questionnaire response library or vendor risk management portal ^[31].

Data residency is only partially documented. Altis offers selectable origin regions including North Virginia, Ireland, London, Frankfurt, Tokyo, Singapore, and Sydney ^[19], but public sources do not clearly confirm U.S.-only data residency or specific regulated-data handling commitments ^[23].

Features for this workload

Questions explored

• What access control and audit logging features does Human Made's Altis Cloud provide for SOC 2 evidence?
• Can Altis Cloud logs be exported to a buyer's SIEM for compliance retention?

Access control and identity features are documented as standard. Altis Cloud publicly lists password-policy configuration, multi-factor authentication, single sign-on, and audit logging as standard security and compliance tools ^[20]. Password security documentation describes bcrypt hashing and configurable minimum password strength ^[5], and the platform replaced legacy iterated MD5 password hashing with modern cryptography ^[23].

Logging and auditability are the strongest compliance-relevant capabilities. Altis documents PHP, Nginx, cron, email, and access logs ^[6]. Audit logs use append-only cloud storage and are retained indefinitely by default ^[2]. CDN access logs can be downloaded, and log shipping sends access logs to a customer-owned S3 bucket - though it is not enabled by default and leaves lifecycle costs and retention management to the customer ^[7]. Some logs have limited documented retention periods; longer retention may require log shipping or customer-managed storage.

Infrastructure hardening supports audit narratives. Production servers have read-only filesystems, the codebase is built into immutable containers, and only deployment triggers changes ^[23]. Altis states this eliminates unrestricted file upload and remote code execution vulnerabilities ^[23]. The platform also describes per-customer keys backed by HSMs, encryption, HSTS, and CSP/SRI support ^[23], and WAF protections against XSS, SQLi, private-file exposure, and DDoS using AWS WAF and AWS Shield Advanced ^[3].

Operational resilience features include autoscaling, high availability, continuous backups, disaster recovery, defined uptime SLAs, and plan-specific recovery objectives ^[20]. An independent G-Cloud listing reports a guaranteed uptime SLA of up to 99.99% depending on tier, with service credits issued for SLA breaches ^[29].

Equivalent compliance evidence beyond SOC 2 includes OSPAR attestation under Association of Banks in Singapore guidelines and Cyber Essentials, listed in a public government procurement record ^[14]. These are useful supporting controls evidence but are not substitutes for a buyer's required SOC 2 report unless the buyer's security team accepts them.

Pricing, renewal terms, and ongoing costs

Questions explored

• How much does Human Made's Altis Cloud cost per year, and what does the $24,000 starting price include?
• Are there setup, overage, or compliance add-on fees on top of the Altis Cloud base price?

Published pricing starts at $24,000 per year for Altis Cloud ^[20]. Annual page-view allowances vary by plan: Plus lists 10 million views, Scale 50 million, and Beyond 200+ million ^[20]. Pricing is primarily based on annual page views, and excess views may trigger additional charges ^[22].

Additional fees are identified but not priced. Published pages identify optional add-ons but do not disclose their prices ^[20]. Optional compliance and reporting work, advanced audit logging, egress gateways, log shipping, extra environments, Elasticsearch, firewall customizations, extra domains, and additional page views may create additional charges ^[20]. Customer-owned S3 log storage creates customer AWS storage and lifecycle-management costs ^[7]. Premium or Enterprise support may cost more than Standard, and public materials do not publish those prices ^[20].

Contract terms are largely undisclosed. The public pricing page does not state minimum contract duration, renewal, cancellation, refund, price-increase, overage, or service-credit terms ^[20]. Anthropic reported an annual contract commitment as standard, with data retained for 90 days post-contract termination before secure deletion, and an end-of-contract offboarding package including customer content, database, and assets ^[31]. Google reported annual billing with customizable enterprise SLAs ^[30]. DeepSeek and Grok found no public pricing or standard contract terms at all ^[10].

Pricing confidence across platforms is moderate at best. OpenAI and Anthropic rated confidence moderate; DeepSeek, Grok, and Perplexity rated it low. The practical implication is that a buyer should treat $24,000 per year as a floor, not a quote.

Best Suited For

Questions explored

• Who is Human Made's Altis Cloud best suited for in a regulated-industry SOC 2 vendor review?
• Is Human Made worth it for a high-traffic enterprise WordPress deployment needing compliance evidence?

Human Made is best suited for regulated or enterprise organizations that require a managed WordPress platform with SOC 2 evidence and can support an enterprise budget (ChatGPT, Claude, Gemini, Perplexity).

Specific fits include high-traffic or mission-critical WordPress deployments needing autoscaling, disaster recovery, WAF protection, staged deployments, and formal support SLAs ^[20]. Buyers that need audit logs, log export or shipping, custom compliance reports, and a technical account manager also align well ^[20]. Large regulated organizations in financial services, healthcare, publishing, and media operating enterprise WordPress at scale are repeatedly named as the core audience (Claude, Perplexity, Gemini).

The platform is documented as trusted by banks, financial services organizations, news organizations, and Fortune 500 companies ^[19]. Premium and Enterprise support plans include a technical account manager, with Enterprise providing a one-hour urgent-response SLA, two-hour priority support, and 24x7 support for all issues ^[20]. Public materials do not confirm that account managers are specifically compliance specialists.

Probably Not Best Suited For

Questions explored

• Who should not choose Human Made for SOC 2 compliance hosting?
• Is Human Made too expensive for a small regulated team that only needs basic compliance documentation?

Small or low-risk WordPress sites should look elsewhere. The published $24,000-per-year starting price is disproportionate for sites that do not need enterprise support, high-scale architecture, or extensive compliance evidence (ChatGPT, Claude).

Buyers requiring a fully public SOC 2 report, fixed pricing, or detailed contractual commitments before engaging sales will find the sales-led model frustrating (ChatGPT, Perplexity, Kimi). Kimi specifically flagged that buyers needing immediate, self-service access to SOC 2 reports are a poor match, and that no public Trust Center, report download portal, or documented NDA process was identified ^[10].

Organizations needing compliance coverage beyond the hosting and managed-service scope - such as application-level controls, customer-owned integrations, or a specific regulatory certification not documented for Altis - should not assume Human Made covers them (ChatGPT). Buyers needing HIPAA BAA or PCI DSS at the WordPress hosting layer are explicitly listed as poor fits by Kimi ^[28]. Organizations seeking monthly or short-term contract flexibility instead of annual commitments are also a mismatch (Claude).

When Another Option May Be Better

Questions explored

• What is a better alternative to Human Made for a buyer who needs self-service SOC 2 report access?
• When should a regulated buyer choose a cheaper SOC 2 hosting provider over Human Made?

Another option may be better in several specific situations. Kimi's research named alternatives with disclosed price points and documented attestation details: Kinsta at $35–115/month with BARR Advisory and 38 controls plus ISO 27001, WP Engine at $20–25/month with Holtzman Partners covering Security and Availability, and Cloudways on DigitalOcean at $14/month with Type II inherited via DigitalOcean ^[28]. Those figures are platform-reported from a single independent review source and should be verified directly.

A buyer needing a lower-cost managed WordPress service without enterprise support, high-scale architecture, or extensive compliance evidence should compare against those options (ChatGPT). A buyer needing a specific certification or contractual framework not demonstrated for Altis - such as a required sector-specific authorization or formally documented data-residency commitment - should evaluate providers that publish those commitments (ChatGPT, Perplexity).

A buyer wanting customer-controlled infrastructure, logging, and identity boundaries rather than a managed multi-tenant platform should consider self-managed or AWS-direct arrangements (ChatGPT). A buyer requiring federal frameworks such as FedRAMP may find federal-specialized enterprise hosts a better fit (Gemini).

Questions to ask before choosing a provider

Questions explored

• What should a buyer confirm with Human Made before signing an Altis Cloud contract for SOC 2 compliance?
• Which SOC 2 report details must Human Made disclose under NDA before procurement approval?

The verification list below consolidates the questions platforms flagged as unresolved. None of these are answered by public sources.

• Can Human Made provide the current SOC 2 Type II report under NDA, including the legal entity, service description, trust-service criteria, audit period, auditor opinion, exceptions, and complementary user-entity controls (ChatGPT, Claude, Kimi)?
• Does the SOC 2 scope explicitly include Altis Cloud infrastructure, managed WordPress operations, support personnel, deployment tooling, backups, logging, CDN, and subprocessors (ChatGPT, Claude, Perplexity)?
• Can Human Made provide a current bridge letter if the report period has ended (ChatGPT)?
• What standard security-questionnaire package, SIG responses, penetration-test summary, policies, and audit evidence are provided, and what are the response times (ChatGPT, Claude)?
• Which features are included in the quoted plan versus paid add-ons, especially advanced audit logging, egress gateways, log shipping, firewall customization, and compliance reporting (ChatGPT)?
• What are the exact log-retention periods for audit, access, application, authentication, and administrative logs, and can logs be exported to the buyer's SIEM (ChatGPT, Kimi)?
• Are audit logs immutable, time-synchronized, access-controlled, and retained for the buyer's required period (ChatGPT)?
• What encryption is used in transit and at rest, how are keys managed, and can customer-managed keys be used (ChatGPT, Claude)?
• What data, metadata, backups, support records, and telemetry leave the selected AWS region (ChatGPT, Perplexity)?
• What are the subprocessors, data-processing terms, incident-notification deadlines, deletion timelines, and customer audit rights (ChatGPT, Claude)?
• What are the minimum term, renewal, cancellation, overage, price-increase, refund, and SLA-credit terms (ChatGPT, Claude)?
• Which customer responsibilities remain for WordPress core, plugins, themes, application code, administrator access, content, and integrations (ChatGPT)?
• Is there a Data Processing Agreement or Business Associate Agreement available for regulated industries such as healthcare (Claude)?
• Does Altis Cloud conduct or publish results of penetration testing, vulnerability assessments, or bug bounty programs (Claude)?

The consensus assessment

Human Made is a strong fit for a regulated-industry buyer whose vendor review specifically requires SOC 2 evidence from an enterprise managed WordPress host and can support an enterprise budget. Do not approve solely on the public SOC 2 claim: procurement should condition approval on receipt and review of the current report, scope, exceptions, contractual security terms, data-handling details, and priced compliance options.

The consensus is not unanimous. Two platforms rated the fit strong, three rated it good, one mixed, and one uncertain. That spread reflects genuine gaps in public evidence rather than disagreement about facts. The certification claim is consistent across sources, but it originates almost entirely from company-owned material. Company-owned citations materially outnumber independent citations in this study, so the SOC 2 claim should be treated as a vendor assertion pending report review, not as independently verified fact.

For buyers comparing providers across the broader category, the soc 2 compliance hosting consensus index aggregates how each provider scored across platforms. Buyers who decide Human Made's enterprise pricing and sales-led procurement model do not fit can review the wider managed wordpress hosting directory for lower-cost alternatives with disclosed attestation details.

How This Review Was Produced

This review was generated from seven AI platform responses collected for the research prompt: a company in a regulated industry going through a vendor risk assessment that must select a WordPress hosting provider able to supply SOC 2 or equivalent compliance documentation and support detailed security questionnaires. The authoritative research date is 2026-10-03.

Platforms evaluated fit for all candidates, but the platform-mentions count in the Research Snapshot reflects only platforms that named Human Made during ranking discovery. Five platforms evaluated Human Made's fit without naming it in their ranking lists.

All citations are platform-reported evidence, not independently verified facts. No personal testing, customer experience, or independent verification was performed. Where a platform supplied no citation for a factual claim, that claim is labeled platform-reported or unverified in the body text.

Research limitations

Several limitations apply to this review.

Platform-reported research dates differ from the authoritative run date. DeepSeek's research is dated 2026-06-01; all other platforms are dated 2026-10-03. Platform-reported dates are provenance metadata and do not independently prove freshness.

The deterministic identity audit flagged that official-site retrieval failed for Human Made's homepage with an HTTP 403 response, and that an exact-name fallback was used to establish identity. The matching reported domain was retained for downstream research but remains unverified. Human Made's domain identity and contracting entity should be confirmed during procurement.

Company-owned citations materially outnumber independent citations. Of the deduplicated sources, 27 are company-owned, 3 are independent, and 2 are unclear. Company claims should not be described as independently verified.

The supplied URLs were collected from platform responses and were not independently validated by the writer stage. The cited SOC 2 announcement contains inconsistent publication metadata, stating an original publication date of March 24, 2026 while displaying September 22, 2026 as the published date.

Missing research is not evidence of absence. Where platforms found no public documentation for questionnaire support, data residency, or contract terms, that reflects a gap in public evidence rather than proof the capability does not exist.

See the broader Regulated Industries Needing SOC 2 Compliance consensus index for comparisons across qualified options.

Sources

Company-Owned Sources

1. Architecture - Altis Enterprise Cloud for WordPress: https://docs.altis-dxp.com/cloud/architecture/
2. Audit Log Storage: https://docs.altis-dxp.com/cloud/audit-log-storage/
3. Web Application Firewall - Altis Enterprise WordPress Documentation: https://docs.altis-dxp.com/cloud/WAF/
4. Security - Altis Enterprise WordPress Documentation: https://docs.altis-dxp.com/security/
5. Password Security - Altis Enterprise WordPress Documentation: https://docs.altis-dxp.com/security/password-security/
6. Accessing Logs: https://docs.altis-dxp.com/v26/cloud/dashboard/logs/
7. Log Shipping: https://docs.altis-dxp.com/v26/cloud/log-shipping/
8. Third Party Plugin Reviews - Engineering Handbook: https://engineering.hmn.md/how-we-work/process/reviews/third-party-plugin-reviews/
9. Security - Altis Enterprise WordPress Documentation: https://help.altis-dxp.com/security/
10. Human Made: https://humanmade.com/
11. Learn more about us – Human Made: https://humanmade.com/about/
12. Altis Cloud - Enterprise WordPress Hosting: https://humanmade.com/altis-cloud/
13. Human Made - Altis: https://humanmade.com/altis/
14. Human Made has achieved OSPAR attestation: https://humanmade.com/how-we-work/human-made-has-achieved-ospar-attestation/
15. Human Made is SOC 2 Certified: https://humanmade.com/human-made-is-soc-2-certified/
16. Human Made is SOC 2 Certified: https://humanmade.com/tachyon/2025/07/soc-2-hero-2.jpg
17. Big news: Human Made is SOC 2 certified: https://humanmade.com/wordpress-for-enterprise/big-news-human-made-is-soc-2-certified-%F0%9F%8E%89/
18. Big news: Human Made is SOC 2 certified 🎉: https://humanmade.com/wordpress-for-enterprise/big-news-human-made-is-soc-2-certified-🎉/
19. Altis: Next-generation enterprise WordPress hosting: https://www.altis-dxp.com/
20. Altis: Pricing for enterprise WordPress hosting: https://www.altis-dxp.com/enterprise-wordpress-hosting-pricing/
21. Financial services trusts Altis Cloud: https://www.altis-dxp.com/financial-services-trusts-altis-cloud/
22. High-scale enterprise WordPress: https://www.altis-dxp.com/scaling/
23. Enterprise Security for WordPress - Altis Cloud: https://www.altis-dxp.com/security/
24. Sleep easy with Altis Enterprise Cloud for WordPress: https://www.altis-dxp.com/sleep-easy/
25. Enterprise Security for WordPress - Altis Cloud: https://www.altis-dxp.com/tachyon/2022/11/ro-filesystem.png?fit=1024%2C1024
26. Pricing for enterprise WordPress hosting - Altis: https://www.altis-dxp.com/tachyon/2026/02/Pricing-featured-scaled.jpg
27. Announcing SOC 2 at Altis: https://www.altis.com/learn/announcing-soc-2-at-altis

Independent Sources

28. Hosting With SOC 2 Compliance in 2026: What You Actually Inherit (and What You Still Have to Build: https://hostingpromax.com/hosting-with-soc-2-compliance-2026
29. Altis - Enterprise WordPress Hosting - Digital Marketplace: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/464392186907232
30. Altis Cloud Review (2026): Pricing, Pros & Cons - iTechGuides: https://www.itechguides.com/altis-cloud-review/

Other Sources

31. Enterprise WordPress Development & Hosting: https://www.applytosupply.digitalmarketplace.service.gov.uk/g-cloud/services/359419293417758
32. Enterprise WordPress Hosting - Altis - Digital Marketplace: https://www.digitalmarketplace.service.gov.uk/g-cloud/services/498424072218567