SOC 2 examination for Insider

Insider has successfully completed the SOC 2 examination.

At Insider, maintaining user data privacy and security is embedded in our culture.

Building data security is a continuous process that shapes the foundation of our development processes and helps to ensure the outstanding performance of our industry-leading technologies. More than 1000 leading enterprise brands trust Insider with their data. As a GDPR-compliant and ISO/IEC 27001 ISMS certified company, data privacy and security lie at the core of our technology — and our culture: We proudly announce that we have successfully completed the SOC 2 Type 1 audit and are committed to performing further SOC 2 examinations in the future.

The scope of our SOC 2 Type 1 Report includes:

Scope: Insider Growth Management Platform

Selected SOC 2 Criteria: Security, Availability, and Confidentiality

Examination Type: SOC 2 Type 1

Review Date: February 28, 2021

FAQ

What is SOC 2?

Service and Organization Controls 2 (SOC 2) is an audit process that evaluates a company’s ability to securely manage the data it collects and uses during business operations. SOC 2 applies to technology-based service organizations that store customer data in the cloud. By undergoing a SOC 2 audit, a SaaS company demonstrates that it’s able to meet the security criteria that prospective customers must see to confidently share their data (and often their customers’ data). The goal of a SOC 2 audit is to make sure that systems are set up to ensure the security, availability, processing integrity, confidentiality, and privacy of customer data.

How do I request a copy of Insider’s SOC 2 Report?

Insider’s SOC 2 report is available to existing and prospective customers who have signed the appropriate non-disclosure agreement. Contact your customer success manager or account executive to request a copy.

Who administers SOC 2? 

SOC 2 is developed and administered by the American Institute of Certified Public Accountants (AICPA).

Who performs a SOC 2 examination?

SOC 2 examinations may only be performed by a licensed CPA firm.

What are the SOC reporting options?

By engaging a licensed and independent CPA to examine and report on a service organization’s controls, service organizations are able to  obtain an objective evaluation of the effectiveness of controls that address operations and compliance and develop financial reporting — both of which are necessary to meet the needs of user entities (customers and prospective customers). 

To provide the framework for CPAs to examine controls and to help management understand the related risks, the AICPA has established three Service and Organization Control (SOC) reporting options:

• SOC 1 Reporting on Controls at a Service Organization (also known as SSAE 16)
• SOC 2 Reporting on Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy
• SOC 3 SysTrust for Service Organizations

What’s in a SOC 2 report?

SOC 2 reports attest to: 

• A service organization’s controls that are relevant to the security, availability, or processing integrity of a system (security, availability, and/or processing integrity criteria) 
• The confidentiality or privacy of the information processed for the user entities (confidentiality or privacy criteria) 

SOC 2 reports are an alternative to SOC 1 (SSAE 16) examinations, which may only attest to a service organization’s controls that are likely to be relevant to user entities’ internal controls over financial reporting (ICFR).

As part of the SOC 2 examination, a service organization may opt to be evaluated against five Trust Services Criteria. An organization may select any combination of the following:

• Security: The system is protected against unauthorized access, use, or modification.
• Availability: The system is available for operation and use as committed or agreed.
• Processing integrity: System processing is complete, valid, accurate, timely, and authorized.
• Confidentiality: Information designated as confidential is protected as committed or agreed.
• Privacy: Personal information is collected, used, retained, disclosed, and destroyed in conformity with the commitments in the entity’s privacy notice and with criteria set forth in generally accepted privacy principles (GAPP) issued by the AICPA and CICA.

Insider, Inc. selected the following three specific Trust Services Criteria: Security, Confidentiality, and Availability.

What are the two types of SOC 2 examinations?

SOC 2 reports that attest to management’s description of a service organization’s system and the suitability of the controls’ design are referred to as Type 1 reports. These examinations always have a review date. Insider completed the SOC 2 Type 1 examination on February 28, 2021.

SOC 2 reports that attest to management’s description of a service organization’s system and the suitability of the controls’ design and operating effectiveness are referred to as Type 2. These examinations always have a review period.

What is a restricted use report?

SOC 2 reports are restricted use reports, which means that only certain authorized users may access and view the report. Generally, authorized users of Insider’s SOC 2 reports include the following: 

• Insider, Inc. management
• User entities (customers) of the services provided by Insider, during the time period of the examination 
• Prospective user entities 
• Independent auditors of current and prospective user entities 
• Other parties who have sufficient knowledge and understanding of Insider’s services covered by the SOC 2 report