Our compliance journey
We use vCISO Lite to manage our own security and compliance program. Here's our story—and our receipts.
Current certifications
Third-party validated security and compliance.
Our SOC 2 Type II report covers a 12-month observation period and validates our security controls are not just designed properly but operating effectively over time.
Our ISMS covers the design, development, and operation of the vCISO Lite platform. We completed the transition to the 2022 standard in our 2024 surveillance audit.
We use Stripe for all payment processing and don't store, process, or transmit cardholder data directly. Our SAQ-A validates our compliance with PCI DSS requirements.
Compliance timeline
Our journey to multi-framework compliance.
SOC 2 Type I certification
Achieved initial SOC 2 certification covering Security trust service criteria. Used vCISO Lite to generate policies and prepare evidence.
ISO 27001 certification
Implemented ISMS and achieved ISO 27001:2013 certification. Gap analysis and control mapping done entirely in vCISO Lite.
SOC 2 Type II underway
Began 12-month observation period for Type II. Continuous monitoring and evidence collection via our own platform.
GDPR compliance program
Formalized GDPR compliance with documented data processing agreements, privacy impact assessments, and data subject rights procedures.
PCI DSS compliance
Achieved PCI DSS compliance via SAQ-A. Validated secure integration with Stripe payment processing.
ISO 27001:2022 transition
Successfully transitioned to updated ISO 27001:2022 standard during surveillance audit.
SOC 2 Type II certified
Completed first full Type II audit with zero exceptions. Auditor noted exceptional evidence organization.
Expanded SOC 2 scope
Added Availability and Confidentiality trust service criteria for comprehensive coverage.
Security documentation
Request our security artifacts for your vendor assessment.
SOC 2 Type II Report
Full audit report covering Security, Availability, and Confidentiality (NDA required)
SOC 2 Bridge Letter
Letter from auditor confirming no material changes since last report
Need documentation for your assessment?
We understand vendor security assessments. Request our security pack and we'll get you everything you need—usually within 24 hours.