SOC 2 Type II

SOC 2 is an attestation framework set by the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines how a service provider protects customer data against the Trust Services Criteria. A Type II report goes further than a Type I: it tests whether the controls actually worked over an observation period, usually between three and twelve months.

Where we are

Vaulty does not have a SOC 2 report. Several of the controls the examination looks at are already part of how Vaulty works. Connections to your ERP, CRM, accounting, files and mail are read-only. Any change in one of your systems is a separate action that a person confirms. Credentials are kept in an encrypted vault for each company, access follows roles and departments, and an audit log records who asked what, which query ran and what came back. Your data is not used to train AI models.

What is planned

Written security policies, a formal risk assessment, multi-factor sign-in for administrators, tested backups and incident response, supplier reviews and an independent penetration test. When these controls have run long enough to be tested, we will engage a CPA firm for a Type II examination. This card will change when the examination starts and when the report is issued. Until then, we will answer your security questionnaire and walk you through our controls.