Why SOC 2 Type II Is a New SaaS Essential
- by Ned Pope
Key takeaway
- SOC 2 Type II has become an essential part of SaaS procurement, often showing up before pricing.
- To simplify compliance, SaaS providers can work with infrastructure as a service (IaaS) providers that already hold a SOC 2 Type II report.
- Hivelocity has a SOC 2 Type II report across our core facilities, enabling SaaS providers to keep their core on hardware that’s part of a reviewed control set.
Procurement is changing. As today’s SaaS customers navigate the vendor selection process, buyers are looking for a SOC 2 Type II report before they even bring pricing into the conversation. Subsequently, SaaS companies now see compliance with standards such as SOC 2 as a primary consideration when selecting infrastructure vendors.
Why SOC 2 Type II Is So Important
There are important differences between SOC 2 Type I and Type II that SaaS vendors should keep in mind as they select infrastructure partners. Type I indicates whether controls were appropriately designed for a specific date. But Type II takes it a step beyond that—examining both how the controls were designed and how they performed throughout a timespan of three to twelve months.
An organization with only a Type I report is essentially still undergoing an audit. And they’ll often be passed over in favor a vendor with a Type II report.
What’s Covered in SOC 2 Type II
An infrastructure provider’s SOC 2 Type II report clearly states important details such as who can access the facility, the power and cooling configuration, and what happens to drives when they’re taken out of service.
In both public cloud and dedicated infrastructure-as-a-service (IaaS) environments, customers inherit their provider’s report and reference it inside their own. Your potential new users are looking to confirm that an independent party has examined the place your data lives.
Hivelocity’s SOC 2 Type II Attested Bare Metal
Hivelocity has a SOC 2 Type II report across our core bare-metal IaaS facilities. This enables our SaaS customers to give their users and prospects the compliance validation they need to move forward.
When you work with us, the physical infrastructure that supports your application stack has already been examined. This includes access, power, cooling, and monitoring. Auditors will accept our attested status as part of your compliance posture.
If you’re looking to reduce infrastructure costs, we can help you there as well. For example, moving the database tier off metered pricing and onto dedicated hardware frees up budget—without opening a compliance gap.
Three Tiers of Attested Environments
The Hivelocity SaaS Bundle is designed with three infrastructure tiers that can help you ensure optimal placement of your workloads. Our SOC 2 Type II report applies across each of them, so your workloads don’t leave the attested zone as they mature. Engineering Compute (Tier 1), Production Compute (Tier 2), and Hi-Scale Compute (Tier 3) run in the same reviewed facilities.
This capability to progress while remaining compliant is critical. Your next prospect’s security review while likely ask where production workloads run when the time comes.
Get in touch today to learn more about the Hivelocity SaaS Bundle.
FAQ
Q: How do SOC 2 Type I and Type II differ? Which do potential customers want to see?
A: A SOC 2 Type I report evaluates whether your controls are compliant as of a specific, single date. A Type II report goes beyond that by also assessing how those controls were designed and how they actually performed over a given period, normally around three to twelve months. Prospects usually prefer Type II because it demonstrates that the controls held up in the real world.
Q: Does Hivelocity’s SOC 2 Type II report cover our application?
A: No. It covers the Hivelocity facilities and the controls that power your application, including access, power, cooling, and monitoring. Your SOC 2 covers your application and the controls you operate. You inherit the facility controls and reference them.
