Security

Trust Issues? Not on Our Watch.

3 min read

You should have trust issues. Anyone about to hand over cloud accounts, cluster administration and deploy pipelines should have them — it is the healthiest instinct in the whole procurement process.

So we deal with them up front. DevOps Team's SOC 2 Type 2 compliance continues, signed off by Atom Assurances Services, our compliance and audit partner, after a full observation window spent inside our controls.

Not a snapshot taken on a good day. A long stretch of ordinary working ones, examined by somebody with no stake in the answer.

What it means on your side of the table

Your security team opens the report, reads an independent opinion, and signs off. One document settles procurement, legal and security at once. The questionnaire that usually sits between a signature and the first commit is already filled in — so the work starts the week you sign.

Compliance is less a trophy than a shortcut you get to hand somebody else's risk team. We keep ours current so you get to skip a month of back and forth.

Type 2 is the one that counts

Two reports carry the SOC 2 name, and the difference between them is the whole game.

Type 1 looks at how controls are designed, on a single date. A photograph.

Type 2 looks at how they actually ran, across months, with evidence pulled from the whole stretch. A recording.

What a Type 1 report covers compared with a Type 2 report A Type 1 report describes the controls as they stood on one date, shown as a single point on the timeline. A Type 2 report covers a continuous observation window spanning the whole period, with evidence gathered throughout it. SOC 2 Type 1 design, one date SOC 2 Type 2 operation, over months a single date a continuous observation window window opens evidence collected throughout report issued Evidence for the lower row is gathered as the year runs. That is the design.
Period the report covers Evidence sampled across the window
Type 1 is a claim about a day. Type 2 is a claim about a year, and the evidence has the dates on it.

We hold the Type 2 because it answers the question you are really asking: how things ran on an ordinary Tuesday in month seven, when everybody had forgotten there was an audit coming. That is the watch part.

We do this for you, too

Same standard, pointed outward. Preparing infrastructure for SOC 2, HIPAA, PCI DSS and ISO 27001 audits is a service on this site — and we run the controls on ourselves first.

If your own audit is on the calendar, the preparation checklist covers what auditors actually ask for, and the HealthTech story walks one through end to end. The clusters we hand over start where Hardening Kubernetes for Production finishes.

Compliance & Audit Partner Atom Assurances Services

Atom Assurances Services conducted our SOC 2 Type 2 examination as an independent CPA firm. Independence is what gives the report its weight.

Want to read it?

Clients and prospective clients can ask through their usual contact, or at [email protected]. It goes out under NDA, the way these reports do.

Ready to hand over the keys?

The security review is the easy part. Tell us what you are running and what is next on the roadmap, and we will scope the work.

Book Free Assessment
← Back to all articles