ScrumLaunch is SOC 2 Type II compliant. We received a clean report covering Security, Availability, and Confidentiality after a nine-month review period, and we share it under NDA.
In this post, we’ll explain what it is, why we went through it, how we approached the process, and what it means for our clients and partners.
If you’re evaluating a software development or AI transformation partner and want to know how they protect your systems and data, this post is for you.
SOC stands for System and Organization Controls. It is a suite of several types of independent reporting services developed by the American Institute of Certified Public Accountants (AICPA). SOC 2, in particular, evaluates how service organizations manage controls related to security and customer data.
The audits can cover up to five TSC (Trust Services Criteria) related to security, availability, processing integrity, confidentiality, and privacy. Security is required in every SOC 2 report. The other four are included when they are relevant to the services being examined. The company selects the criteria that apply to its scope.
The scope of ScrumLaunch covers three of the five TSC:
There are two types. A Type I report is a snapshot: the controls are suitably designed on a given day. A Type II report covers a period of time and shows that the controls worked throughout it. Type II is harder to get and more meaningful, which is why we opted for it.
An independent auditor examines how a company protects client data and whether it follows its own policies in practice.
Our clients have increasingly been asking us to demonstrate SOC 2 compliance. That's the main reason behind our decision. At some point, promising that we would obtain SOC 2 in the future, while continuing to answer security questionnaires and explain our internal practices, simply stopped being enough. Security and operational maturity have become a basic requirement for working on sensitive or larger products.
And it's easy to understand why. When a company hires an external software development team, that team gets access to systems, repositories, and often sensitive business or client data. Security reviewers at our clients’ companies, especially those in regulated or enterprise-bound spaces, need clear proof that a vendor handles that access properly.
A SOC 2 report gives them independent evidence to consider during their vendor security reviews. Also, many of our clients are SOC 2 compliant themselves, and it’s a lot easier to use a vendor who also has it.
SOC 2 is intentionally flexible. It sets expectations for the outcomes a company should achieve, but doesn't prescribe exactly how every control must be implemented.
For example, different companies may use different tools and procedures to manage access to sensitive information, depending on their services, infrastructure, and risks. As a result, two companies can meet the same requirements through quite different approaches, with different levels of rigor.
That's why a SOC 2 badge alone doesn't tell the whole story about a company's security practices. It’s specifically the report itself that provides context about which criteria were included in the examination, what controls were evaluated, how they operated during the review period, and whether the auditor identified any exceptions.
Many companies adopt governance, risk, and compliance (GRC) platforms that help them demonstrate how their controls meet criteria relevant to their examination scope.
Such platforms, for instance Vanta or Secureframe, are useful when a company is building its compliance process for the first time or needs to coordinate many teams and systems. They help with managing policies, evidence collection, and continuous monitoring.
But that wasn’t the path we chose. In our case, we already understood much of the process from helping clients prepare for SOC 2. We knew the requirements, the evidence needed, and the practical realities of operating the controls. Besides, in our opinion, doing it ourselves keeps the work tightly aligned with how we actually operate rather than forcing processes to fit a platform’s templates.
So we decided to work directly with our existing policies, procedures, and technical controls instead of introducing another platform into our workflow.
A SOC 2 report is not something a company can issue for itself. So, after the internal work is in place, you need an independent auditor to examine the controls and issue the report.
We selected Accorp Partners as our independent auditor. The firm has experience working with software and product companies.
Our Privacy and Security Officer, Serhii Kaihorodov, was responsible for the audit. He coordinated the process and worked with the relevant team members to prepare the necessary documentation and evidence. This included reviewing the controls within the examination scope and coordinating with the auditor.
The work involved documenting and refining policies, enforcing company-wide two-factor authentication, rolling out security awareness training, tightening access controls, reviewing vendor management, strengthening incident response procedures, and ensuring our infrastructure and development practices met the required criteria.
The important part was that our preparation was not simply about collecting documents for the audit. We needed to demonstrate that the relevant security practices were established and followed as part of our regular operations. For a Type II examination, this also means assessing whether the controls operated effectively over the review period, rather than checking only whether they were documented or properly designed at a particular point in time.
The review period lasted nine months, and it took about two more months for the auditor to complete the examination and issue the report.
As a result, we have received a clean report covering the Security, Availability, and Confidentiality criteria with no exceptions.
For a software development and AI product partner, reliability and security are not side concerns. They are core to the work we do.
Our responsibility for security does not end with protecting the systems and data our clients share with us. It also extends to the way we develop software: how our developers access client environments, handle source code and sensitive information, and build applications that process business data. As development workflows undergo significant changes, especially because of growing use of AI tools, maintaining clear security practices across these activities becomes even more important.
Prospective clients have asked about our security certifications when evaluating us, and this report gives them a direct answer. That alone made the effort worthwhile.
But for ScrumLaunch, the value goes far beyond having a report to share. Preparing for the examination helped us document our controls, clarify responsibilities, and establish consistent practices across the company. These improvements matter regardless of whether a particular client ever asks about our SOC 2 report. They help us manage the systems, information, and access entrusted to us more consistently.
The report is a milestone, not the end of our work in this direction. We will keep maintaining and improving the controls we have established as we grow.
If you are evaluating ScrumLaunch and need the SOC 2 Type II report for your security review, reach out, and we will share it under NDA. The report shows how we operate day to day, and covers security, availability, and confidentiality, the three areas that matter most when a vendor works inside your systems and with your data.
If your security team has questions about the report or about how we handle access to your systems, contact us, and we will be glad to answer any of your questions.
Identify ROI opportunities in your workflows.
SOC 2 is an independent examination and reporting framework developed by the AICPA. An independent auditor evaluates a company's controls and issues a report describing the examination scope and results. Although people often say 'SOC 2 certified' or 'SOC 2 compliant,' technically, a company receives a SOC 2 report rather than a certification.
The global e-commerce market now covers 20-50% of total retail sales. In Asia, countries are leading, but Europe and the United States are rapidly accelerating development of online sales. By 2027, the online retail market is projected to reach $8 trillion (Statista).
How much does a startup financial model cost in 2026 — and can ChatGPT replace a CFO? This guide explains what AI does well in financial modeling, where it fails, and how founders should use it safely.
Comprehensive guide to building a travel app like Kayak, including pricing, essential features, outsourcing vs in-house teams, and ongoing costs.
