Security, privacy and availability come first for a company whose software runs other companies’ operations. In October 2023 InThing completed a SOC 2 Type 1 examination: an independent auditor reviewed how our controls are designed and issued a report on them.
What a SOC 2 report is
System and Organization Controls (SOC) 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). It looks at how a service provider protects customer data against five trust services criteria: security, availability, processing integrity, confidentiality and privacy.
A Type 1 report describes the provider’s systems and whether its controls are suitably designed as of a specific date. A Type 2 report also tests how those controls operate over a period of months. In both cases the result is an auditor’s attestation, not a certificate.
How we prepared
We started in the first quarter of 2023 with a gap analysis and a series of internal audits run with a third party. Their findings shaped new and updated policies and process documentation. Once those were in place, we went through the external examination.
The controls apply to how Visium and Trapeze are built, tested and deployed, and our agile development process works within them. At the time of the report we committed to repeating the examination every year.
What it means for customers and partners
Our customers run critical services on InThing, so their security teams need more than our word when they review the service design. An independent report gives them a verified starting point, and it gives partners confidence in the standards behind the software they resell and deploy.
The report is shared with customers and prospects under NDA. Our page on security and trust covers deployment options, access control and data handling.