Torii is SOC 2 Type II Compliant, Are You?

💡 Key Points:

• Every technology company should heavily consider SOC 2 certification as the gold standard for security 
• Compliance is the means, not the goal
• Let Torii help you get SOC 2 ready
• Learn more about how Torii prioritizes security. 

From day one, security and compliance have been top of mind for our product and development teams. Since Torii manages mission-critical SaaS applications and the data inside them, there was just no question about it. That being said, undergoing an independent third-party audit, such as SOC 2, is an invaluable way to both test and affirm those values. But is SOC 2 compliance right for you and your organization? 

SOC 2 is a certification developed by the American Institute of Certified Public Accountants (AICPA) that provides a way to measure the operating effectiveness of a company’s controls as they relate to Security, Availability, and Confidentiality. 

Preparing for SOC 2 is a company-wide effort. To succeed, you need the full support of everyone on the team. When we completed our SOC 2 compliance in 2019 as a small team of just 20 employees, it was with that support and dedication that we were able to enter our observation period this year and come out the other side with no exceptions noted.

SOC 2 is the gold standard that technology companies must meet today. It applies to nearly every SaaS company, as well as any company that uses the cloud to store its customers’ information.

Why You Should Consider SOC 2 Compliance

Small = Agile

For a young company, embarking on the SOC 2 compliance journey may be daunting. It is a time-consuming process that involves almost every aspect of your product and business. Every ongoing internal practice and procedure must be compliant.

But instead of referring to it as a hurdle, your company's "youth" might be an asset. Being able to craft things ‘as they should be’ at a very early stage is easier than fixing long-lived ill processes; having all the folks on board, and committed to the success of the process, as is the case in young companies, makes the implementation of any necessary change a breeze. So rather than delay a challenge, think of it as an integral part of your top-priority tasks for the year.

Compliance is a Means, Not a Goal

Compliance is just one factor of the business, but it is not the end goal. Instead, think of compliance as a way to identify problems or shortcomings. Then, design good controls that can integrate cleanly into existing workflows. Forcing new work methods that don't "fit" in the name of compliance is a dangerous game and, in many cases, can actually lead to more risk! When you introduce procedural changes do so strategically. 

Company Culture > Obligation

A SOC 2 audit isn’t a one-time test or an obligatory checklist! Remember, compliance is the means, not the goal. Instead, truly internalize the policies and procedures you commit to, making them a real part of your corporate culture. We like to think of it as a marathon rather than a sprint, and as any experienced marathon athlete knows, you are never really done, not even when you cross the finish line. In the back of your mind, you’re already evaluating what you could have done differently and how you can improve at your next practice and on your future run.

Automation is Key

The whole idea behind audits and certifications like SOC 2 is implementing clear procedures and controls. Managing the influx of information your organization produces every day is a task of its own. How you handle that daunting task is critical to the long-term success of your security efforts.

At Torii, we lean heavily on automation to ensure that procedures are kept, efficiency is maintained, and our employees can focus on valuable, customer-centric work.

These principles also form the foundation of the way we run our business as a whole, and they have proved incredibly valuable to the overall process. We built the automation with auditability in mind so that when we have to show what’s going on or prove that a certain procedure is practiced, we have a report ready to go! 

Ready to Get the SOC 2 Certified?

For tech companies of all sizes, SOC 2 is an important verification of their priorities. Understanding the responsibility of maintaining customer data in a secure way is so important! It's a responsibility that we don't take lightly, and neither should you! 

If you're ready to get the SOC 2 stamp of approval, check out this article about how Torii can help get you ready, or request a demo to learn more! 

Good Luck!