Compliance reads as capability here.

Civic has achieved SOC 2 Type 2 compliance, building on our SOC 2 Type 1 attestation and confirming that our security controls operate effectively over time to protect client data and maintain the highest security standards across our company.

SOC 2 Type 2 compliance, established by the American Institute of Certified Public Accountants (AICPA), evaluates our security controls and practices over a defined period rather than at a single point in time. Where a Type 1 attestation confirms that controls are suitably designed as of a specific date, a Type 2 attestation confirms that those controls were both suitably designed and operating effectively throughout the examination period. It covers the same three critical trust service criteria: security, availability, and confidentiality.

The audit involved an independent examination of our internal controls, security policies, and operational procedures across the entire period under review. Auditors tested our data handling practices, access controls, system monitoring, and incident response capabilities, gathering evidence that each control performed consistently over time. This thorough review confirmed that our controls were suitably designed and operating effectively to meet the SOC 2 criteria, aligning with recognized security and compliance standards.

Our commitment extends beyond simply meeting audit requirements. Compliance and security criteria are baked into how we design, build, and operate everything we offer, acting as a continuous discipline rather than a point-in-time milestone. For the go-to-market teams who run on Civic, and the compliance and finance leaders accountable for every vendor they approve, that is the difference between a control that checks a box and one that fulfills the underlying criteria.

Civic has achieved SOC 2 Type 1 compliance, underscoring our commitment to protecting client data and maintaining the highest security standards across our company.

SOC 2 Type 1 compliance, established by the American Institute of Certified Public Accountants (AICPA), evaluates our security controls and practices at a specific point in time. This attestation confirms our controls are suitably designed to meet rigorous industry standards as of the audit date. It covers three critical trust service criteria: security, availability, and confidentiality.

The pre-audit process involved extensive evaluation of our internal controls, security policies, and operational procedures. Independent auditors examined our data handling practices, access controls, system monitoring, and incident response capabilities. This thorough review confirmed that our controls were suitably designed to meet the SOC 2 criteria, aligning with recognized security and compliance standards.

Our compliance extends beyond meeting audit requirements. We've integrated security considerations into every aspect of our business, from how we design and build our products to how we operate them for the go-to-market teams who depend on Civic. Security is a standing priority, not a one-time exercise.

Civic passed Google's Cloud Application Security Assessment (CASA) Tier 2 certification. An authorized third-party lab tested our platform against key security requirements mandated by the App Defense Alliance's Tier 2 standard, which is based on OWASP ASVS v4.0, and found no high-risk vulnerabilities. The App Defense Alliance, led by Google, Meta, and Microsoft, administers this assessment.

CASA Tier 2 evaluates application security controls across 14 critical security categories. Independent assessors examined our API security, access controls, data handling practices, cryptographic implementations, and authentication flows. They mapped our code against common weakness enumerations with high exploit potential and verified compliance with OWASP ASVS Level 2 requirements.

Supply chain security has become central to enterprise risk management. Organizations now face requirements to verify the security posture of every vendor in their technology stack. CASA Tier 2 gives clients concrete evidence for stakeholder reviews and audit requirements — an official Letter of Validation (LoV) rather than self-certification.

For the assessment, our engineering and security teams enhanced secure coding practices, strengthened continuous security testing, and refined threat modeling processes. The lab conducted Dynamic Application Security Testing (DAST), reviewed our source code using Static Application Security Testing (SAST), and validated our defenses against the OWASP Top 10 and beyond.