At Docuverus, security is not something we take lightly. We know that you are entrusting us with your documents containing your personal information. You trust us with the keys to your life and we have a responsibility to treat them with the greatest care.
And we know security. Some of us have built tactical systems for the U.S. military, after all. But we are also smart enough to know that relying on ourselves isn’t enough. That’s why we hire third-party security companies to attack our systems so we can see how they respond. It’s also why we invested in, and passed, a SOC 2 audit. The AICPA defines this audit as a critical examination of policies, procedures, and operations. It covers Trust Services related to Security, Availability, Confidentiality, Processing Integrity, and Privacy.
For our SOC 2 journey, we partnered with Thoropass to examine all aspects of our security posture.
What Our SOC 2 Compliance Work Covered
Here are a handful of areas our SOC 2 compliance work covered.
Infrastructure
Validating against SOC 2 controls, we hardened our systems against attack and tested our authentication policies. We also exercised our disaster recovery and business continuity plans, and added continuous monitoring for vulnerabilities.
Software
We follow state-of-the-art software development processes, including agile,, lean, and continuous integration. To secure our software even further, we tightened these processes. They now better protect against malicious actors, infected libraries, and vulnerable code.
Data
Protection of our client data is central to everything we do. We more tightly defined our policies and procedures to protect data against theft and other threats from sources both internal and external. We also hardened our detection and monitoring procedures to identify changes to configurations that result in the introduction of new vulnerabilities.
People
We believe in an unwavering commitment to integrity and ethical behavior. We have always had a rigorous onboarding process for new employees, including a thorough background check. Now, we have added well-defined processes to maintain this commitment as we grow.
Risk Assessment and Mitigation
Managing risk is a part of any business. Managing risk with a disciplined approach takes time, commitment, and dedication to do the work. We chartered a formal risk committee. It regularly identifies, prioritizes, monitors, and mitigates risks across the company’s operations.
As you can see, obtaining our SOC 2 compliance was not an easy task. Rather than just checking some boxes, we wanted to leverage the compliance process to make us more secure, more disciplined, and more mature as a company. And SOC 2 is an ongoing process, requiring a formal audit every year. As we move forward, we will continue to leverage the process to ensure we maintain the highest standards with respect to the Trust Services.
Frequently Asked Questions
Is Docuverus SOC 2 compliant?
Yes. Docuverus has completed and passed a SOC 2 audit, the AICPA-defined examination of policies, procedures, and operations covering Security, Availability, Confidentiality, Processing Integrity, and Privacy. The audit was conducted in partnership with Thoropass.
How does Docuverus protect applicant documents and personal data?
Applicant documents contain sensitive personal information, so Docuverus treats them as such: engineered safeguards built by a team with experience building tactical systems for the U.S. military, independent third-party security firms hired to attack the systems and test how they respond, and SOC 2 controls audited across the full security posture.
Does Docuverus use third-party penetration testing?
Yes. Docuverus hires outside security companies to attempt to breach its systems, on the principle that internal confidence is not evidence. Those tests are run in addition to, not instead of, SOC 2 controls.
What should property managers ask a screening vendor about data security?
Whether they hold a current SOC 2 report and who audited it, whether independent penetration testing is performed and how often, where applicant documents are stored and for how long, and who on the vendor’s side can access them.
