Eminenture meticulously follows SOC standards, defining who to access what data, how to protect client data, how we respond when something breaks, and how to match what we promise with what happens in practice.
What "SOC" Actually Means
SOC stands for “Service Organization Controls”, which outlines a structured way to prove that a company’s internal controls are designed properly and they actually work with evidence.
We prepare an independent report where we cover every piece of information, record, workflow, or file that our clients and security teams share. Majorly, we prepare two reports resonating with our portfolio:
- SOC 2: This is the most crucial report for our clients, comprising how we examine all controls around security along with availability, confidentiality (privacy), and other criteria relevant to client information.
- SOC 1: This report is significant, comprising services relating to our clients’ financial reporting. Simply put, it audits the controls over the financial data and processes we manage on their behalf via outsourcing.
And each report comes in two forms:
- Type 1 is a snapshot defining on what date our controls were designed properly.
- Type 2 is a descriptive overview, covering every control that existed and ran over a particular period, usually six to twelve months, without any failure.
We document our projects per Type 2 because it reveals a year of workflows, data, documents, or whatever we did over a period.
What the Examiners Actually Look At
In everyday terms, the independent examiners audit the security measures we take.
- Who gets in, and how: Firstly, it includes details of every person with a system that deals with client data, showing reasons, and reviewed access. It also covers the access that is no longer needed & hence, is removed.
- What happens when things change: It also covers any change to our systems needing review and approval before it goes live, so nobody deploys something half-finished into production.
- What if something breaks: An ironclad plan is prepared to cover in this report, encompassing the plan, debug, and how we actually detect, fix, and report incidents.
- Is client data protected in motion and at rest: We ensure that the clients’ data is encrypted, masked, and put under strict access limits. It matches the same process that we follow to secure our sensitive data.
- Who we are relying on: We assess, contract, and monitor data or any asset provided by the third party because our chain is only as strong as its weakest link.
- Are the right people trusted with this: We ensure to conduct background screening where appropriate, provide role-based training, and define clear lines of accountability.
- Do we watch our own back: We infallibly log and monitor points that would cause a problem quickly and regularly review to determine whether the controls are still working.
If the auditing team finds any gap, it is reported to fix, track the fix, and put this record in the next cycle.
What This Means for You
- Safe space: The aforesaid protocols define our IT infrastructure as a safe digital environment where your data is controlled and checked by matter experts.
- Your own audits get faster: When the contract is signed, our SOC report answers most of the critical queries related to data security before they are even asked.
- The report is real evidence, not marketing: This report ends all suspicions that pop up in the minds of our clients or auditors.
- We tell you what's in scope and what isn't: We do not create mystery. Whatever we examine, the report comprises. And if there is any point resonating with laws beyond borders, we manage it under the same standards anyway.
How We Report
However, an SOC report defines what protection and privacy we maintain over a span. It does not mean we pause this activity afterward.
- Continuous evidence collection: We continue to define, run, and monitor recurring processes month-wise, but not once a year.
- Annual re-examination: We conduct internal audits every year, with the scope updated as our services grow.
- Exception management: Any flow or data management less than perfect is logged, owned, and fixed on a fixed timeline.
- Bridge letters: We prepare interim reports for the gap between our client’s request and our latest report date.
- Independent review of the reviewer: We change examination firms periodically, so no single auditor ever gets comfortable.