Company
Surfaice Is Now SOC 2 Type I Compliant
Surfaice has completed its SOC 2 Type I audit. The report was issued by Advantage Partners, an independent audit firm, and confirms that our security controls are designed to protect the data our customers trust us with.
What SOC 2 is
SOC 2 is a security framework governed by the American Institute of Certified Public Accountants (AICPA). In a SOC 2 audit, an independent auditor reviews a company's policies, procedures and evidence to judge whether its controls are designed and operating as they should. A Type I report looks at how those controls are designed at a point in time.
Why it matters for retail teams
Surfaice works inside the systems retail real estate, construction and facilities teams already run: leases, budgets, schedules, email. Before a team connects any of that, its IT and security reviewers need to know how the data is handled. A SOC 2 report answers that question with a third party's opinion rather than our own.
It covers the commitments we already make:
- Read-only by default. Surfaice reads the systems you run and gives the work back to your team; every workspace runs in its own isolated silo.
- US-hosted. Customer data stays in the US, on Google Cloud.
- No training on customer data. No model, ours or a vendor's, is trained on it.
- Encryption and access control. TLS 1.2+ in transit, AES-256 at rest, multi-factor authentication, role-based access and audit logging of all data access.
How we got here
We worked with Vanta (opens in a new tab) to connect our systems, put our policies and procedures in place and collect the audit evidence. Advantage Partners (opens in a new tab) then confirmed we were ready, ran the audit and issued the report.
What comes next
Security is ongoing work, not a box we checked once. Type I is the first step: a Type II report tests the same controls over a period of months, and SOC 2 is renewed every year.
Getting the report
Customers and prospects can request a copy of our SOC 2 Type I report under NDA. Our security page lists what Surfaice can see, what it stores and who approves it.