What is SOC 2
The Service Organization Control
SOC is an internationally recognized auditing standard for security compliance.
The SOC 2 Type II Report is issued to an organization following a 6-12 month audit of every facet of the organization; including: the financial stability and longevity of the company, documenting every procedure, firewall security, disaster recovery, secure protocols for database access, and ensuring security compliance among all employees.
Trust Services Principles
The security principle refers to protection of system resources against unauthorized access. Access controls help prevent potential system abuse, theft or unauthorized removal of data, misuse of software, and improper alteration or disclosure of information.
IT security tools such as network and web application firewalls (WAFs), two factor authentication and intrusion detection are useful in preventing security breaches that can lead to unauthorized access of systems and data.
The availability principle refers to the accessibility of the system, products or services as stipulated by a contract or service level agreement (SLA). As such, the minimum acceptable performance level for system availability is set by both parties.
This principle does not address system functionality and usability, but does involve security-related criteria that may affect availability. Monitoring network performance and availability, site failover and security incident handling are critical in this context.
The processing integrity principle addresses whether or not a system achieves its purpose (i.e., delivers the right data at the right price at the right time). Accordingly, data processing must be complete, valid, accurate, timely and authorized.
However, processing integrity does not necessarily imply data integrity. If data contains errors prior to being input into the system, detecting them is not usually the responsibility of the processing entity. Monitoring of data processing, coupled with quality assurance procedures, can help ensure processing integrity.
Data is considered confidential if its access and disclosure is restricted to a specified set of persons or organizations. Examples may include data intended only for company personnel, as well as business plans, intellectual property, internal price lists and other types of sensitive financial information.
Encryption is an important control for protecting confidentiality during transmission. Network and application firewalls, together with rigorous access controls, can be used to safeguard information being processed or stored on computer systems.
The privacy principle addresses the system’s collection, use, retention, disclosure and disposal of personal information in conformity with an organization’s privacy notice, as well as with criteria set forth in the AICPA’s generally accepted privacy principles (GAPP).
Personal identifiable information (PII) refers to details that can distinguish an individual (e.g., name, address, Social Security number). Some personal data related to health, race, sexuality and religion is also considered sensitive and generally requires an extra level of protection. Controls must be put in place to protect all PII from unauthorized access.
How does this affect me?
Knowing that your data is secure and that it does not contain vulnerabilities similar to other enterprise software that can have issues with role authentication and budgetary information is crucial.
Do you value?
Highly secure, with robust risk management policies and implementation of controls
Reliable and constantly available, with extensive solutions regarding environmental protection, backup/restoration of data, disaster recovery, business continuity, and much more
Optimized and capable of quickly generating and storing accurate information for clients
Confidential, at all times acting as a safe platform to disclose and store highly sensitive information
Constantly aware of and enforcing informational privacy for all facets of business
We are SOC 2 Type II Certified
View our SOC2 certification