Surge Ventures, the Parent Company of RegVerse Achieves SOC 2 Certification: Setting New Standards in Wealth Management Industry Data Security
Understanding SOC 2
SOC 2 is a framework established by the AICPA in 2010. It provides essential guidelines for technology and cloud computing organizations to ensure the effective management and security of customer data.
What is SOC 2 Type II Certification All About?
SOC 2 can be considered as an auditing procedure designed to ensure that service providers manage data securely, protecting client privacy and interest. For companies handling customer data, SOC 2 compliance is a basic requirement when choosing a SaaS provider.
SOC 2 Type II reports are especially thorough, assessing the effectiveness of a company’s controls over a period of time rather than just at a single point.
Surge Ventures LLC: A Commitment to Excellence
Surge Ventures LLC, founded in December 2022, operates globally with a focus on the financial services and wealth management sectors. The company aims to bring multiple SaaS startups to market, addressing emerging compliance risks such as advisor data governance, client privacy obligations, and user data management.
Ensuring Trust and Security: Surge Ventures LLC SOC 2 Type II Report
In today’s digital age, data security and privacy are crucial. Companies can show their commitment to protecting sensitive information through SOC 2 Type II certification.
Surge Ventures LLC, a prominent FinTech Venture Studio, has recently completed its SOC 2 Type II audit, highlighting its dedication to high security standards and operational excellence.
Key Highlights from the SOC 2 Type II Report
The SOC 2 Type II report for Surge Ventures LLC covers the period from May 23, 2024, to August 21, 2024. Here are some key highlights:
Independent Service Auditor’s Report: The audit by Johanson Group LLP evaluated the design and effectiveness of Surge Ventures’ controls. The report confirmed that these controls were well-designed and operated effectively during the review period.
Management’s Assertion: Surge Ventures’ management affirmed the appropriateness and effectiveness of their control design and operation. This affirmation is crucial as it showcases the company’s dedication to robust security measures.
Description of Surge Ventures: The report provides a detailed overview of Surge Ventures’ system, covering its infrastructure, software, personnel, data, and processes. It emphasizes the company’s use of advanced technologies and methodologies to ensure data security and operational efficiency.
Test of Controls and Results: The report outlines the specific controls evaluated and their results, providing crucial evidence of the effectiveness of Surge Ventures’ security measures.
Surge Ventures’ Comprehensive Security Measures
Surge Ventures employs a multi-faceted approach to security, encompassing various aspects such as:
Infrastructure: Surge Ventures leverages both Heroku and AWS services to deliver a robust and scalable infrastructure. This setup includes container runtimes for web services, CI/CD systems, transactional databases, and caching mechanisms.
Software: Surge Ventures’ primary development language is Ruby, with Rails as the web application framework. The company also uses PostgreSQL for transactional databases and Redis for job queue management.
People: Surge Ventures employs over 100 people, including contractors, across management, product development, product operations, and commercial roles. Each team plays a crucial role in maintaining the company’s security posture.
Data: Surge Ventures manage three main categories of data: log, customer, and configuration data. Strict access controls are used by the organization to safeguard sensitive data, and all data is encrypted while in transit and at rest.
Processes and Procedures: The organization has established IT policies and procedures covering data communication, logical access, computer operations, change control, and physical security. These policies ensure compliance with relevant laws and regulations.
Surge Processes and Procedures
Surge Ventures has formal IT policies for physical security, logical access, computer operations, change control, and data communication, accessible on the intranet.
Physical Security - Surge operates remotely and all data is hosted on AWS, with no physical access for employees.
Logical Access - A role-based access control system is used to manage infrastructure access, guaranteeing least-privilege access. Roles for workers and contractors include Administrator, User, and No access. To ensure security, roles are reviewed once a year.
Employee Identification and Access - O365 accounts are used by employees for SSO. Within 14 days, new hires finish their security and onboarding training. Accounts that are terminated are disabled in three days.
Computer Operations – Backups and Availability - AWS is used to backup customer data. The health of the application is tracked, and there is an incident response policy in place. If a critical incident is not acknowledged within an hour, it is escalated.
Change Control - SDLC policies guide changes, tracked via a ticketing system. Version control software maintains source code history.
Data Communications - PaaS simplifies network configuration and automates container management for production infrastructure. Penetration testing is done annually, and vulnerability scans are done quarterly. Cloud and SaaS apps are protected by TLS connections.
Surge Risk Assessment Process
Surge Ventures uses an annual risk register to monitor and control risks. The development process incorporates high-risk tasks.
Integration with Risk Assessment - Controls are implemented to address unique risks, ensuring criteria are met. Management identifies risks and necessary controls.
Surge Information and Communications Systems
Surge Ventures communicates via email, Intercom, Microsoft Teams, and Jira. SaaS apps are used to share data, and meetings are used to discuss priorities.
Monitoring Controls - Management monitors controls and employee adherence, taking corrective actions as needed.
On-Going Monitoring - Training and monitoring for quality assurance are done on a regular basis. Control flaws are fixed to guarantee performance and compliance.
Reporting Deficiencies - Monitoring results are tracked by an internal tool. Annually, deficiencies and actions are reviewed, and high-risk issues are escalated and addressed.
Achieving Compliance Excellence with Responsible AI
In financial services, responsible AI is essential for compliance. It ensures regulatory adherence, enhances risk management, builds customer trust, and protects data. Using AI-powered tools, ethical frameworks, data governance, and human oversight sets a higher industry standard, fostering a trustworthy and ethical financial ecosystem.
Unified Platform by Surge Ventures
Surge Ventures offers a range of services to streamline compliance and enhance security for financial services firms. RegVerse offerings include:
It shows the company’s dedication to high security standards and operational excellence, assuring clients and partners that their data is well-protected.
Conclusion
In an era where data breaches and cyber threats are increasingly common, companies must prioritize security and compliance. Surge Ventures LLC’s SOC 2 Type II certification is a testament to its dedication to safeguarding client data and maintaining trust.
Surge Ventures sets a high bar for the industry through its rigorous security standards, ensuring that clients can rely on their services with utmost confidence.
.png){kind=avatar}
