What is SOC 2 & Why is it important?

SOC 2 or Service Organization Controls 2 is a framework that is governed by the American Institute of Certified Public Accountants (AICPA). With a SOC 2 audit, an independent service auditor will review an organization’s policies, procedures, and evidence to determine if their controls are designed and operating effectively. A SOC 2 report communicates a company’s commitment to data security and protection of customer information.

Improving your security posture

SOC 2 compliance exemplifies an organization’s commitment to their customer’s trust and is a major milestone towards improving their overall security posture. With increasing cybersecurity threats and data breaches, it is paramount that organizations prioritize information security and the protection of their systems and data. By undergoing a SOC 2 audit, our controls and processes were validated by a third-party who attests to the functioning of the controls relevant to our application.

Why we pursued SOC 2 now

SOC 2 compliance is an integral step in proving to customers, stakeholders, and interested parties that our organization values their trust and has effectively implemented security controls. At our company’s stage, we realized that it was an ideal time to pursue this as it is important to protect data and mitigate potential security risks early and on an ongoing basis.

Even though we are early-stage, we understand the importance of trust, especially in the AI age where data is increasingly valuable. Our pursuit of SOC 2 compliance is a testament to our commitment to ensuring the highest level of security for our customers' data. We believe that the trust of our customers is paramount, and we are dedicated to continuously improve our security posture to protect their data. Our goal with completing SOC 2 is to assure our customers that we are taking all necessary steps to protect their data and uphold security as our top priority.

DealPage’s journey to SOC 2 compliance

When we started our SOC 2 journey, we had one main goal in mind: build security into our processes, not just tick boxes on a checklist. We know that each company is unique and has its own security needs. So, we made sure our approach was customized to fit our organization and customers, instead of trying to squeeze into a one-size-fits-all compliance mold. This is an ongoing effort that will need constant attention. We are super committed to this now and going forward.

As an AI-focused company, we understand concerns around how data gets used, particularly when it comes to training LLMs. We've taken this concern to heart. By obtaining SOC 2 compliance, we're not just ensuring the security of data, but also demonstrating our commitment to using it ethically and responsibly. We hope this helps build trust and assure our customers that their data is being handled with the utmost respect and transparency.

Starting early was another big part of our strategy. We learned that the sooner you start working on your policies, the smoother the whole process goes. It's easier to weave security practices into your company culture and day-to-day operations right from the start. Infrastructure security is a big chunk of SOC 2 compliance, and modifying existing infra is not easy. We spent long days working through our AWS services improving security while trying to keep services running for users. Plus, the 6 month audit window means you need to start before you actually need SOC 2 to close a deal.

Closing Thoughts

SOC 2 can be a “checkbox” thing for a lot of teams. As a startup, it really did serve as a helpful foundation for how we think about compliance and security. It was a lot of work but completely worth it.

‍