TruPoint achieves SOC II Type 2 attestation
TruPoint Technology has completed an independent SOC II Type 2 examination covering the Security, Availability, and Confidentiality trust service criteria. The examination period covered October 1, 2025 through March 15, 2026, and was conducted by a PCAOB-registered auditing firm.
The report is available under NDA to existing clients and prospective enterprise customers through their account manager or by contacting privacy@trupoint.com.
What was covered
The SOC II examination covered TruPoint’s private cloud infrastructure, the TruCompliance ISMS platform, and our managed security operations (24/7 SOC, XDR, and SIEM services).
Key areas included:
- Logical access controls — MFA, privileged access management, access reviews
- Change management — infrastructure change controls and approval workflows
- Incident response — detection, escalation, and client notification procedures
- Backup and recovery — immutable backup controls and tested restore procedures
- Vendor management — sub-processor onboarding and oversight
- Monitoring — log retention, SIEM alerting, and SOC operating procedures
Zero exceptions were noted in the audit period.
What this means for clients
Clients who use TruPoint services as part of their own SOC II or ISO 27001 program can now request the TruPoint report as evidence that our controls meet attestation standards. This is particularly relevant for:
- Financial services clients with carrier or regulator reporting requirements
- Professional services clients undergoing their own SOC II Type 2 examination
- Clients seeking evidence for cyber insurance renewals that require vendor SOC II documentation
What’s next
We are currently pursuing ISO 27001 certification with a target completion of Q3 2026. The certification audit will cover the same scope as the SOC II examination, plus additional domains relevant to our Canadian data centre operations and ISMS platform.
Questions? Contact your account manager or email privacy@trupoint.com.