Permutive successfully completes the SOC 2 and SOC 3 audits

We’re thrilled to share that we have successfully completed the SOC 2 and SOC 3 audits. Permutive has always been a pioneer of privacy-forward advertising, and this achievement solidifies our commitment to meeting the highest security standards.

But what do these reports mean for us and our customers? In this blog post, we’ll explain what these reports are, what they cover, and why we chose to undergo this rigorous compliance audit. 

What is a SOC 2 report? 

Obtaining a System and Organization Controls (SOC) 2 report is one way for a service organization to attest to the security of its digital environment. Completing a SOC 2 examination through an accredited third-party auditor does not result in any certification. Instead, the resulting CPA’s report functions as a tool to help an organization communicate whether the internal controls they’ve put in place governing the security of customers’, partners’, and stakeholders’ data are properly designed, implemented, and maintained. In simpler terms, a SOC 2 report provides an avenue for current and potential stakeholders to assess risk by giving them a closer look at the policies and procedures put in place to ensure the organization’s services are provided safely and reliably. 

What is a SOC 3 report?

A SOC 3 report is similar in scope to a SOC 2 report, but the information is packaged more concisely. This makes SOC 3 reports easier to read and a better fit for widespread distribution. Both reports result from the same audit, and both can help communicate that an organization’s controls are properly designed and implemented and operating effectively. 

What do these reports cover? 

SOC reports results from an examination performed by an accredited CPA firm under the standards defined by SSAE 18. An auditor tests the effectiveness of the internal controls outlined by the organization and then maps those controls to one or a combination of Trust Services Criteria established by the American Institute of Certified Public Accountants (AICPA). In our case, that criterion was security and that the system is protected against unauthorized access (both physical and logical).

The scope of a SOC report can also vary with regard to the time period covered. SOC 2 Type II reports examine controls over a period of time, usually between three and 12 months, and include both a list of the controls tested as well as the auditor’s test results. The reporting period for Permutive’s latest SOC 2 and SOC 3 reports spanned from November 1, 2022, to April 30, 2023.

Why did we undergo this exam? 

Receiving our SOC 2 and SOC 3 reports marks a huge step forward in Permutive’s efforts to demonstrate our commitment to data security and ensure that we’re prepared to face the challenges of the ever-changing cybersecurity landscape. 

Where can I go for more information? 

Our auditing partner, BARR Advisory, has provided a comprehensive overview of the different types of SOC examinations and their unique requirements for cloud service organizations. If you are interested in obtaining a copy of our latest SOC 2 Type II or SOC 3 reports, contact us at [email protected].