SOC 2 compliance
An independent CPA firm audits our security and privacy controls. Here’s what that means, and why it matters when you choose an IT provider.
Where we stand
- SOC 2 Type 1: complete. Our report was issued in mid-2026.
- SOC 2 Type 2: underway and nearly complete.
- What the audits cover: the Security and Privacy Trust Services Criteria.
- Between audits: we monitor our controls continuously, and our Trust Center shows where each one stands.
What SOC 2 is
SOC 2 is a standard from the AICPA (the American Institute of Certified Public Accountants) for companies that hold or manage other organizations’ data. An independent CPA firm examines the company’s controls, the policies, practices and technology that protect that data, against the AICPA’s Trust Services Criteria, and reports what it found.
- A Type 1 report says the controls are designed properly, at a point in time.
- A Type 2 report says they worked as designed, tested over a period of months.
Every SOC 2 audit covers security. Ours also covers privacy: how personal information is collected, used, kept and disposed of.
SOC 2 isn’t a certificate or a self-assessment. It’s an outside auditor’s opinion, based on evidence the auditor checked.
Why it matters in an IT provider
A managed IT provider holds the keys to its clients’ systems: administrator accounts, remote-access tools, backups and network equipment. That makes IT providers a target, because an attacker who breaks into one can reach every business it supports. Your IT provider’s security is part of your own.
A SOC 2 report gives you:
- Proof, not promises. An independent auditor has examined our security and privacy controls, rather than taking our word for them.
- Easier vendor reviews. When your auditors, examiners, cyber insurer or customers ask how you vet the vendors that can reach your data, our report answers many of their questions.
- Help with your own compliance. Finance, broker-dealers, healthcare, legal and government organizations are expected to check the security of the service providers they rely on. An audited provider makes that easier.
- Security that lasts. SOC 2 isn’t a one-time project: we monitor our controls continuously, so they stay in place between audits.
What our controls cover
Our Trust Center lists our security controls in five groups:
- Infrastructure security: a unique login for every person; access to systems, databases, firewalls and networks limited to those who need it; and access removed when someone leaves.
- Organizational security: background checks for new employees; confidentiality agreements and a code of conduct for employees and contractors; encrypted portable media; anti-malware protection; and media holding confidential data wiped or destroyed, with a certificate for each device destroyed.
- Product security: data encryption, penetration testing and self-assessments of our controls.
- Internal security procedures: business continuity and disaster recovery plans, written and tested, and cybersecurity insurance.
- Data and privacy: policies for classifying and keeping data, and clients’ data deleted when they leave.
Our data center has its own audit
Our cloud servers, cloud desktops and colocation are hosted in a carrier-neutral data center with its own SOC 2 Type 2 report. Its report covers the facility; ours covers adrytech’s own security and privacy controls.
Request our SOC 2 report
SOC 2 reports are written for clients and partners, not the public, so ours is shared on request. Ask for access in our Trust Center; once we’ve approved your request, you can download the report there.
Have a question about our security or the audit? Contact us or call (602) 892-4771.
Talk to us
Tell us what you need, and we’ll follow up with a free consultation and quote.