A data collection tool you can trust: We’re SOC 2 certified

Logo obtained from AICPA SOC for Service Organizations 

Data security is more important now than ever

A data breach is the last thing you, or the people you collect data from, should ever have to worry about. This is why we’ve invested in an independent audit to evaluate our ability to safeguard customer data and how well we manage the internal processes, permissions, and systems that prevent risky data practices.

We’re proud to say SurveyCTO is SOC 2 Type 2 certified. This certification attests to our:

• Security
• Availability
• Processing integrity
• Confidentiality
• Privacy

SOC 2, or System and Organization Controls 2 certification, is an auditing process to assess the trustworthiness of services provided by a software service organization. The Type 2 certification observes operations for a specified period of time, while Type 1 evaluates security at a specific point in time.

To become SOC 2 Type 1 certified in 2021, we worked with an independent auditing firm throughout 2020. In 2022, we took our certification to a new level by achieving Type 2 certification. Today, our SOC 2 Type 2 audits continue as part of our commitment to exceptional data security and compliance.

What does the SOC 2 Type 2 certification process entail?

An independent auditor evaluates SOC 2 against the Trust Services Criteria set by the American Institute of Certified Public Accountants (AICPA). According to A-LIGN’s guide to SOC 2, meeting the security criterion is required in every SOC 2 report, and organizations can add the other four criteria.

SurveyCTO’s audit covers all five:

1. Security: Our secure systems protect data. For example, fully customizable user permissions and siloed spaces for teams protect against unauthorized access. End-to-end encryption and data redundancy help you submit data securely.
2. Availability: SurveyCTO is accessible, meaning our data collection tools are equipped to perform well and we have systems in place to handle security incidents appropriately.
3. Processing integrity: You can trust SurveyCTO to process data accurately and in a timely manner. This doesn’t necessarily guarantee data integrity, as data may contain errors when entered into the system, but we have quality assurance procedures and features baked into the software to further increase reliability.
4. Confidentiality: We keep confidential data confidential. We restrict access to the people who need it and grant access based on mutually agreed-upon terms.

5. Privacy: We adhere to our privacy policy, which means:

   • We don’t ask you for personal information unless we need it.
   • We don’t share your personal information with anyone except to comply with the law, develop our products, or protect our rights.
   • We don’t store personal information on our servers unless required for the ongoing operation of one of our services.

Our certification results demonstrate our: 

• Commitment to software security best practices
• Secure management of user data
• Robust internal compliance processes that protect your privacy and data

It’s crucial not to have any weak links in your data collection processes

The SOC 2 certification is a reliable way to know you can trust an organization to adhere to its data security standards, and our standards are high. Data security is the backbone of what we do. 

Here’s how SurveyCTO compares to other data collection service companies when it comes to data security certifications.

As a company, we’re SOC 2 certified. Other tools, including the platforms below, may be hosted on SOC 2 certified platforms like Amazon Web Services (AWS).

The below is based on publicly available information at the time of publication. You can learn more about other survey platforms’ security standards by visiting their websites or reading their security policies.

Some platforms host their data in SOC-accredited data centers rather than holding a company-level SOC 2 report.

Because vendors’ certifications change over time, check each platform’s security or trust page for its current status before you decide.

How does SOC 2 fit into SurveyCTO’s broader security?

Our SOC 2 audits cover how Dobility, the social enterprise behind SurveyCTO, hosts and operates your servers. Dobility protects those servers with an externally audited information security compliance program, including external penetration testing and SOC 2 audits. You can see how these pieces connect on our SurveyCTO security and compliance page.

Server security is a shared responsibility. Our audited controls protect the platform, and you decide how your team accesses and handles data. Your built-in data security options include:

• End-to-end encryption that keeps your data hidden even from SurveyCTO engineers
• User roles that limit each team member to the access they need
• Single sign-on (SSO) and external authentication
• Mobile device security requirements for field teams

We document the best practices for secure data collection and walk you through each setting in SurveyCTO. We are is also compliant with the Health Insurance Portability and Accountability Act (HIPAA). Read how SurveyCTO achieved HIPAA compliance.

Learn more about SOC 2 certification and our commitment to data security

When you review any vendor’s SOC 2 report, check:

• The report type (Type 1 or Type 2)
• The audit period
• The Trust Services Criteria in scope
• The auditor’s opinion

All paid users of SurveyCTO benefit from our SOC 2 certification, with Pro, Advanced, and Enterprise users getting annual access to our audit report. If you are interested in accessing the report or have questions about our certification, you can learn more on our Pricing page or email us at info@surveycto.com. 

To learn more about our fundamental principles and how we adhere to them, read our Privacy Policy. It provides an overview of our commitment to privacy through our software and internal policies.

If you’re interested in a General Data Protection Regulation (GDPR)-compliant software setup, our GDPR overview explains your options.

To learn more about SOC 2 certifications in general, explore:

• This article on the importance of SOC 2 compliance for security-minded businesses
• The AICPA SOC for Service Organizations toolkit

Try SOC 2 certified survey software with a free trial