SOC 2 Trust Services Criteria
ScopeOps is designed and operated in alignment with SOC 2 Type II Trust Services Criteria, providing comprehensive controls across security, availability, processing integrity, confidentiality, and privacy.
Security (CC)
Controls to protect system resources against unauthorized access, disclosure of information, and damage to systems.
Key Controls:
- Logical access controls (RBAC)
- Encryption at rest and in transit
- Authentication (SSO, MFA, SAML 2.0)
- Security monitoring and incident response
Availability (A)
System availability and operational performance monitoring to meet service level commitments.
Key Controls:
- SLA monitoring and threshold alerts
- Uptime tracking and reporting
- Disaster recovery and backup procedures
- Performance monitoring and capacity planning
Processing Integrity (PI)
System processing is complete, valid, accurate, timely, and authorized.
Key Controls:
- Data validation and quality checks
- Change management and version control
- Error handling and logging
- Reconciliation and audit procedures
Confidentiality (C)
Information designated as confidential is protected as committed or agreed.
Key Controls:
- Data classification and handling
- Encryption (AES-256, TLS 1.3)
- Access controls and least privilege
- Secure data disposal
Privacy (P)
Personal information is collected, used, retained, disclosed, and disposed in conformity with commitments.
Key Controls:
- Privacy notice and consent
- Data minimization and retention
- Right to access and deletion
- Third-party risk management
Evidence Automation
Automated evidence collection and audit trail maintenance for continuous compliance and audit readiness.
Key Capabilities:
- Governance Audit Trail for all changes
- Automated evidence collection
- Compliance Pack generation
- Real-time audit logging
Technical Security Controls
Enterprise-grade security infrastructure with encryption, authentication, and monitoring.
Encryption & Authentication
Encryption at Rest
AES-256 encryption for all data stored in databases and file systems. Encryption keys managed with industry best practices.
Encryption in Transit
TLS 1.3 for all network communications. All API endpoints require HTTPS with modern cipher suites.
HMAC Token Authentication
HMAC-SHA256 signatures for API authentication. Tokens expire after configurable time periods and support rotation.
SSO & SAML 2.0
Enterprise SSO with SAML 2.0, OAuth 2.0, and OpenID Connect. Multi-factor authentication (MFA) support.
Access Control & Monitoring
Role-Based Access Control (RBAC)
Granular permissions based on roles and organizational hierarchy. Principle of least privilege enforced.
Rate Limiting
API rate limiting to prevent abuse and DDoS attacks. Configurable limits per user, role, and endpoint.
CAPTCHA Protection
CAPTCHA challenges on login and public-facing forms to prevent automated attacks and bot abuse.
Security Monitoring
Real-time security event monitoring, alerting, and incident response. Comprehensive audit logging for all system access.
Compliance Resources
Access compliance documentation, audit trails, and SLA monitoring tools.
Compliance Pack
Comprehensive compliance documentation including SOC 2 controls, security policies, and evidence artifacts.
Request Compliance Pack →Governance Audit Trail
Complete audit trail of all governance activities, change requests, approvals, and Demand conversions with full traceability.
Learn More →SLA Monitoring
Real-time SLA threshold tracking, breach notifications, and compliance reporting for service level commitments.
View Dashboards →Evidence Automation
Continuous compliance and audit readiness
ScopeOps automatically collects and maintains evidence for all compliance controls, eliminating manual evidence gathering during audits. The Governance Audit Trail captures every change to projects, demand requests, governance decisions, and approvals with full context.
What's automated:
- Access control logs (who accessed what, when)
- Change management records (all project and portfolio changes)
- Approval workflows and decision logs
- Demand-to-project conversion audit trails
- Security events and incident response
- SLA compliance and breach notifications
- User authentication and session management
The Compliance Pack provides a comprehensive view of all controls, evidence artifacts, and audit-ready documentation. Evidence can be exported for auditors with timestamp verification and cryptographic integrity checks.