We are excited to announce that AverCare is now SOC 2 compliant. Following an independent audit by Advantage Partners, we have received our SOC 2 report, which confirms that our handling and processing of customer data meets key security standards.
What is SOC 2 and why is it important?
SOC 2, or Service Organization Controls 2, is a framework governed by the American Institute of Certified Public Accountants (AICPA). In a SOC 2 audit, an independent service auditor reviews an organization's policies, procedures and evidence to determine whether its controls are designed and operating effectively. A SOC 2 report communicates a company's commitment to data security and the protection of customer information.
Improving our security posture
SOC 2 compliance reflects our commitment to our members' trust and is a major milestone in improving our overall security posture. With cybersecurity threats and data breaches on the rise, it is essential that organizations prioritize information security and the protection of their systems and data. Through our SOC 2 audit, our controls and processes were validated by a third party that attests to the functioning of the controls relevant to our platform.
Why we pursued SOC 2 now
SOC 2 compliance is an important step in showing our members, partners and stakeholders that we value their trust and have put effective security controls in place. At AverCare's stage, it was the right time to pursue it, because protecting data and reducing security risk works best when it starts early and continues on an ongoing basis.
AverCare brings together some of the most personal information there is: the signals from your wearable, your health history, your goals and your conversations with Aver. We are preparing to launch, and we wanted the foundations that protect that information to be independently verified before our first members join, not after. Our goal is simple: when you share your health with AverCare, you should be able to trust exactly how it is looked after. We will continue to maintain our SOC 2 compliance and renew our report as AverCare grows.
AverCare's journey to SOC 2 compliance
Compliance partners
- Vanta. We partnered with Vanta, the leader in the trust management space, to help us automate the collection of our audit evidence. Vanta gives us a strong security foundation to protect our members' data.
- Advantage Partners. Our audit firm, Advantage Partners, was extremely helpful in creating a seamless audit experience. With their guidance and support, we were able to achieve SOC 2 compliance in a swift, efficient manner.
Process
While SOC 2 can be a big undertaking, our compliance partners streamlined the process. We used Vanta to integrate our key systems and to guide us in putting policies and procedures in place so we could become audit ready. Vanta gave us the direction we needed throughout our compliance journey.
Advantage Partners then confirmed our audit readiness and we began our audit. Advantage evaluated the controls we have in place and gave their opinion on them. Shortly after our audit window ended, Advantage Partners drafted and issued our report.
Timeline
One key takeaway is that improving security posture and achieving compliance takes dedicated focus and time. The right compliance partners make it far easier, and by making compliance a priority across the team we were able to move quickly through the readiness period, which is usually the longest part.
We also found it valuable to agree the audit timeline with Advantage Partners early, set a target audit date and work backwards to be ready in time. Now that our controls are in place and security is part of how our team works every day, future SOC 2 audits will be even more seamless.
Lessons we learned
Focus on security, not checking boxes
Compliance is not one size fits all. The real value of SOC 2 was not the report itself but the work behind it: understanding our risks and building controls that fit how AverCare actually operates. Security is a continuous project, and it has to stay a priority long after the audit is complete.
Start the process early
It is far easier to build secure policies, procedures and infrastructure while a company is young than to retrofit them later. Pursuing SOC 2 before launch meant security shaped our platform from the beginning rather than being added on afterwards.
The right partners are key
Having a platform to guide us through the process, and an audit firm dedicated to our success, made a demanding project manageable. We are grateful to Vanta and Advantage Partners for their support in reaching this milestone.
What comes next
SOC 2 is one part of our wider commitment to protecting the people who trust us with their health. We will keep monitoring our controls and strengthening our security program as AverCare grows. Organizations that would like to review our SOC 2 report can request a copy by getting in touch through our Corporate page.
AverCare is pre-launch. If you want a health platform that takes your data as seriously as your health, join the waitlist and be among the first to experience it.
