Assembly is SOC 2 Type II compliant.
Independently audited against the AICPA's five trust service principles: security, availability, processing integrity, confidentiality, and privacy. Continuous compliance monitoring in production, not a one-time certification gathering dust.
SOC 2 Type II is the operational standard most procurement teams ask for when evaluating a technology vendor at scale. Type I tests whether controls are designed correctly at a point in time. Type II tests whether those controls actually operated effectively over a sustained audit period of six to twelve months. Assembly holds Type II.
The audit standard
Five trust service principles, audited annually.
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA). It evaluates how an organization manages customer data across five categories. Each is independently tested by a third-party auditor.
PRINCIPLE 01
Security
Systems and data are protected against unauthorized access, disclosure, or damage. Includes access controls, network security, encryption at rest and in transit, vulnerability management, and incident response.
PRINCIPLE 02
Availability
Systems are available for operation and use as committed. Includes uptime monitoring, performance management, business continuity planning, and disaster recovery procedures tested under realistic conditions.
PRINCIPLE 03
Processing integrity
System processing is complete, valid, accurate, timely, and authorized. Includes change management, deployment controls, data validation, and the audit trails that prove processing happened the way it was supposed to.
PRINCIPLE 04
Confidentiality
Information designated as confidential is protected from unauthorized access. Includes data classification, access restrictions, encryption practices, and the operational controls that govern who sees what.
PRINCIPLE 05
Privacy
Personal information is collected, used, retained, disclosed, and disposed of in accordance with the organization's privacy notice and the AICPA's Generally Accepted Privacy Principles. Includes consent management, data subject rights, and retention controls.
ASSEMBLY HOLDS
SOC 2 Type II compliance across all five.
Independently audited, with the report available under NDA on request from procurement teams. Annual audit cadence with continuous monitoring between audits.
What it means in practice
What this means operationally.
SOC 2 Type II is operational, not aspirational. It changes how the work gets done day-to-day, not just how the company describes itself.
01
Continuous monitoring
Security controls and operational practices monitored in production every day, not just before an audit.
02
Independent third-party audits
Annual review by a licensed auditor with no skin in the outcome. Findings drive corrective action, not marketing copy.
03
Verified data & uptime safeguards
Encryption, access controls, backup and recovery procedures tested and proven over the audit period.
04
Vendor management discipline
The same controls apply to our subcontractors and third-party services. Trust does not stop at the company boundary.
Compliance automation
Continuous monitoring through Drata.
SOC 2 compliance lives or dies in the gap between audits. Most organizations pass an audit and then drift. Controls degrade, evidence collection lapses, and the next audit becomes a fire drill.
Assembly partners with Drata, a leading compliance automation platform, to monitor controls continuously. Evidence is collected automatically, control failures are surfaced in real time, and the operational state of compliance is visible to the team that has to maintain it, not just to the auditor once a year.
The result is less audit theater and more actual security. The certificate is the byproduct of the practice, not the goal.
Procurement Q&A
Common questions from vendor security teams.
The questions that come up most often during vendor security assessments and procurement reviews.
Can we get a copy of your SOC 2 Type II report?
Yes. The full SOC 2 Type II report is available under a mutual non-disclosure agreement on request. Most procurement teams have a standard NDA they use for this purpose. The report includes the auditor's opinion, the scope of the audit, the controls tested, and any exceptions found during the audit period.
Which trust service principles are you audited against?
All five: security, availability, processing integrity, confidentiality, and privacy. Some organizations scope their SOC 2 audit narrowly to security only. Assembly's audit covers the full set, which is the broader and more rigorous scope.
When was your most recent audit?
Audits are conducted annually. The most recent report covers the most recent audit period. Specific dates are available on request as part of the report package.
Were there any exceptions or qualifications in the report?
Audit exceptions, when they occur, are addressed before the next audit cycle as part of standard remediation discipline. Specifics are documented in the report itself, available under NDA.
What about subcontractors and third-party services we'd be exposed to through you?
Vendor management is part of the SOC 2 control set. Third-party services that handle customer data are reviewed for their own security posture as part of the audit scope. The same control discipline applies to subcontractors who would be assigned to client engagements.
Do you also hold ISO 27001 or other certifications?
SOC 2 Type II is our primary security attestation. For clients in regulated industries with specific compliance needs (HIPAA, PCI DSS, FedRAMP), we scope engagements to align with the regulatory environment in question. Talk to us about specific requirements during scoping.
How does this affect engagements where we'd be sharing sensitive data?
SOC 2 controls govern how Assembly handles client data internally: access, transmission, storage, retention, and disposal. For engagements involving sensitive data, the same control discipline applies. Specific data handling requirements (data residency, encryption standards, access logging) are scoped during engagement setup.
Where compliance fits
Part of how we work, not a separate thing.
SOC 2 Type II is one piece of a broader operational discipline at Assembly. The same operational rigor (security designed in from the foundation, governance built into platforms, identity-first architecture) shows up in how we engineer for clients, not just in how we run our own systems.
Complex digital estates don't respect domain boundaries. Security, identity, and governance run through every layer of an estate: the cloud foundation, the applications running on it, the data platforms feeding intelligence services, the content systems serving customers. SOC 2 compliance is what proves Assembly operates that way internally. The same discipline shows up in how we engineer for clients: built in from the start, not bolted on at the end.
Talk about security posture
Procurement teams looking for the SOC 2 report or details on our security posture can reach the right person directly.