Assurance means that an independent auditor has audited our security and privacy measures and has confirmed that all security and privacy measures are adequately a) designed to cover the risks, b) implemented and c) operational effective during the audit period. 

The best known and accepted assurance framework is the SOC 2 ® (Service Organization Control) audit report that provides detailed information and assurance about a service organisation's security, availability, processing integrity, confidentiality and/or privacy controls as international standard of AICPA (SOC 2 Trust Service Criteria for service organizations, March 2020 updates). All large service providers (like SAP, Oracle, AWS, Hubspot) provide a SOC 2 report to their customers. We therefore also provide you with a SOC 2 report.

Assurance and SOC 2 ® have two levels: type 1 and type 2: 

• Type 1 means that an independent auditor has audited if the security and privacy measures exist and are in line with the design. 

• Type 2 means that the independent auditor audits if the security and privacy measures exist and are in line with the design but also audits if all security and privacy measures are also operational effective during the audit period (past one year). 

Therefore our SOC 2 ® type 2 report is the highest level of certainty that can be provided to you as an employer about the implemented security and privacy measures.

Both the ISO27001 and the assurance / SOC 2 framework are well known international frameworks but provide for you as an employer a huge difference in the level and assurance of implemented security and privacy (S&P) measures. 

The main advantages of SOC 2 above ISO27001 are: 

• SOC 2 includes privacy as ISO27001 only covers security;

• ISO27001 is only a statement of the implemented measures on a certain moment (“photo”, type 1). SOC2 provides proof that controls are operational effective in the past year (“video”, type 2);

• ISO27001 provides a certificate for 3 years in future without commitment of management. SOC 2 provides a signed statement from management about commitment to continue to perform security and privacy controls in the upcoming year;

• Getting and maintaining SOC 2 level takes serious (out-of-the-pocket) investment in comparison with an ISO27001 certificate; showing the commitment of an organization taking security and privacy seriously.
  

The above shows that the SOC 2 type 2 is the highest level of certainty that can be provided about the implemented security and privacy.

For this, please visit the "documentation" section of this Trust Center.

The SOC 2 report is made in English. We also have a German translation but this version is not signed. The external IT auditor has provided a signed explanation letter to state that the English version is the original SOC 2 report version and that the German version is provided to you as an employer with the aim of increasing readability for German customers.