We’re thrilled to announce a monumental milestone in our security journey: ePayPolicy has officially received our SOC 2 Type 2 report.
We’ve always prioritized data security, proudly maintaining our status as a PCI-compliant payment processor. But as cyber threats evolve, we want to push our security posture further.
This new designation represents an additional Third-Party Audit of our security infrastructure, going far beyond payment processing to validate the comprehensive security of our entire organization. Here is a breakdown of what this achievement entails, how it differs from our previous milestones, and what it means for our clients and connected partners.
Beyond PCI Compliance: What Does a SOC 2 Report Actually Mean?
Until now, our highest security designation was our strict adherence to the Payment Card Industry Data Security Standard (PCI DSS). PCI compliance is incredibly important; it ensures that we handle, process, and store credit card information in a highly secure environment. However, PCI is narrowly focused on cardholder data.
SOC 2 (System and Organization Controls 2), established by the American Institute of Certified Public Accountants (AICPA), is a different beast. It’s a comprehensive auditing standard that evaluates how a cloud-based service provider handles all sensitive information, not just credit card numbers.
We received our SOC 2 Type 2 report (technically known in the auditing world as an “unqualified opinion”) with no major findings, it means an independent, third-party auditor meticulously examined our internal systems, policies, and procedures and found that we operate exactly as securely as we claim to. There were no exceptions, no gaps, and no red flags.
To achieve this, we had to prove our operational excellence across the AICPA’s Trust Services Criteria:
- Security: Our systems and data are fortified against unauthorized access, both physical and logical. We use advanced firewalls, intrusion detection, multi-factor authentication, and rigorous access controls to keep bad actors out.
- Availability: Our platform is available for operation and use as committed or agreed. We have robust disaster recovery and network performance monitoring systems in place so you can process premiums without interruption.
- Processing Integrity: Our system processing is complete, valid, accurate, timely, and authorized. When an insured pays a premium with any payment method, the data moves flawlessly from point A to point B without unauthorized manipulation.
- Confidentiality: Information designated as confidential is fully protected. We restrict access to data to only the personnel who absolutely need it to perform their jobs.
- Privacy: Any personally identifiable information (PII) we collect, use, retain, and disclose is handled in strict conformity with our privacy notices and internal policies.
Why Our SOC 2 Report Matters to Our Insurance Customers
You might be wondering, “But how does it impact my insurance business?”
In the modern insurance ecosystem, your business is only as secure as the weakest link in your vendor chain. Here is why ePayPolicy’s SOC 2 Type 2 report directly benefits your daily operations and your bottom line:
1. Protection for Policyholder Data
Insurance professionals collect vast amounts of sensitive data. While PCI compliance protects your clients’ payment details, our SOC 2 report validates that our entire operational infrastructure protects their Personally Identifiable Information (PII). Whether you are taking a payment for a high-net-worth personal lines policy or a complex commercial account, you can assure your clients that your payment partner meets the gold standard for enterprise data security.
2. Faster Vendor Due Diligence and Compliance
If you operate an MGA, carrier, or large retail agency, your internal compliance and IT teams likely require strict vendor risk assessments. A SOC 2 Type 2 report can sometimes be a “fast pass” for vendor due diligence. Instead of filling out endless security questionnaires, we can provide our SOC 2 report, satisfying the rigorous compliance requirements of your partners and internal auditors.
3. Platform Reliability
Insurance moves fast, and payment delays can result in policy cancellations, coverage lapses, and frustrated clients. Because the SOC 2 audit rigorously tests our Availability and Processing Integrity, you have third-party validation that ePayPolicy is engineered to stay online and process transactions accurately. We’re built to handle high volumes of premium payments with zero friction and maximum uptime.
4. Mitigating Reputational and Financial Risk
Data breaches don’t just result in financial penalties; they destroy reputations. By partnering with a SOC 2-audited vendor, you’re mitigating operational risk. It gives third-party validation that we have implemented internal controls that adhere to the best practices outlined in the Trust Services Criteria.
- Regulatory Compliance Peace of Mind
For our customers who are regulated as Covered Entities under additional frameworks, ePayPolicy goes above and beyond the core five Trust Services Criteria (including HIPAA mapping as a Business Associate Agreement and NY DFS mapping as a third party service provider) to give you complete regulatory peace of mind for how our controls align with these additional regulatory requirements.
Our Ongoing Commitment to Customers
Receiving our SOC 2 Type 2 report is not a one-and-done event; it’s an ongoing commitment. We will continue to undergo rigorous annual audits to ensure our security controls scale alongside our technology and the growing needs of the insurance industry. At ePayPolicy, your security is our priority, and this milestone is just one more way we are working to be the most trusted payment solution in the insurance space.
Frequently Asked Questions (FAQs) About ePayPolicy’s SOC 2 Compliance
Q: What is the main difference between PCI compliance and SOC 2?
PCI compliance is a mandate created by major credit card companies specifically to ensure the secure handling of credit card data. SOC 2 is a broader, voluntary standard created by the AICPA that evaluates a service organization’s overall information security, privacy, and operational controls. While PCI secures the transaction, SOC 2 secures the entire organization.
Q: Does ePayPolicy still maintain its PCI compliance?
Yes, absolutely. Achieving SOC 2 does not replace our PCI compliance; it builds upon it. ePayPolicy remains fully PCI DSS compliant, giving you layered, comprehensive security for both cardholder data and general organizational data.
Q: What does a “clean” or “unqualified” SOC 2 report mean?
A “clean” or “unqualified” report means that the independent auditing firm found no significant issues, deviations, or gaps in our security controls. It signifies that we successfully met all the stringent requirements of the AICPA’s Trust Services Criteria without exception.
Q: How does ePayPolicy’s SOC 2 report help my agency with its own compliance?
When your agency undergoes regulatory audits or applies for cyber liability insurance, you are often required to prove that your third-party software vendors are secure. Providing our SOC 2 report to your auditors or IT team instantly verifies that your payment processor meets enterprise-grade security standards, saving you time and streamlining your compliance efforts.
Q: Who conducts the SOC 2 audit?
SOC 2 audits are conducted by independent, accredited third-party Certified Public Accountant (CPA) firms or auditing agencies. These auditors specialize in information security and rigorously test an organization’s systems over an extended period to ensure continuous compliance.
