Visionify Completes Its 2026 SOC 2 Type II Audit

Key Takeaways

• Audit complete: Visionify's SOC 2 Type II report covers the audit period July 16, 2025 to July 15, 2026
• Three trust services criteria: Security, Availability, and Confidentiality
• Continuous coverage: This is a consecutive Type II period, following our 2025 report — no gap between audit windows
• Independently examined: Conducted by an external CPA firm against the AICPA trust services criteria
• Available on request: The full report is confidential, and we share it directly with customers, prospects, partners, and regulators

A Full Year of Tested Controls

We've completed our SOC 2 Type II audit for the period running July 16, 2025 through July 15, 2026. The report covers the trust services criteria for Security, Availability, and Confidentiality, examined against TSP section 100 and described in accordance with the AICPA's DC 200 description criteria.

The distinction between Type I and Type II matters here. A Type I report evaluates whether controls are designed appropriately at a single point in time. A Type II report tests whether those controls actually operated effectively across an entire period — in our case, a full twelve months. It's the difference between showing that a lock exists and showing that it was locked every day for a year.

This is our second consecutive Type II period. Our previous report covered July 16, 2024 to July 15, 2025, which means our audit windows are continuous, with no uncovered gap between them. For security teams evaluating vendors, that continuity is often as important as the report itself.

What the Audit Covered

The examination looked at the controls behind the Visionify workplace safety platform, including:

• Access control and authentication across our systems and customer environments
• Change management for how code and infrastructure changes are reviewed and released
• Risk assessment processes and how identified risks are tracked to resolution
• Incident management, including detection, response, and post-incident review
• Third-party and subservice organization management — our platform uses AWS for cloud infrastructure, and the report addresses the complementary controls that relationship depends on
• Business continuity planning and testing
• Monitoring of system availability and security events

The report also documents Complementary User Entity Controls (CUECs) — the responsibilities that sit with you, our customer, in order for the overall control environment to work as designed. If you're running a vendor security review, that section is usually worth reading closely.

Why This Matters for Workplace Safety AI

Visionify processes video from cameras inside your facilities. That is genuinely sensitive material, and we've built the platform around that reality — edge-first processing so footage doesn't need to leave your environment, face blurring, and person anonymization that tracks safety behaviors rather than identifying individuals.

Architecture claims are easy to make in a sales deck. A SOC 2 Type II report is how those claims get tested by someone who doesn't work for us. It gives your security team independently examined evidence rather than our word, which is what most enterprise procurement processes will ask for anyway.

Requesting the Report

Our SOC 2 Type II report includes detailed descriptions of our controls, the tests our auditor performed, and the results of those tests. That level of detail is exactly what makes it useful to your security team — and exactly why it carries a restricted-use clause limiting distribution to customers, prospects, business partners, practitioners serving them, and regulators.

So we don't publish it as an open download. Instead, you can request it directly and get access immediately:

Request the SOC 2 Type II Report

Fill in the short form on our compliance page and the report opens right away — there's no waiting on a manual approval step. Our team is notified of each request so we can follow up if you have questions about anything in it.

If you're working through a formal vendor security assessment and need supporting material — completed questionnaires, our GDPR audit report, or architecture documentation — reach out and we'll help.

Our Ongoing Security Program

The audit is a checkpoint, not the program itself. Between audit periods we continue to run:

• Regular internal control reviews and evidence collection
• Penetration testing and vulnerability management
• Security awareness training for all employees
• Access reviews and least-privilege enforcement
• Incident response exercises

We'll begin our next Type II period immediately, maintaining continuous coverage.

Learn More

For a fuller picture of how we handle data — our architecture, privacy controls, and deployment options — see our Security & Trust Center and our Compliance page.

If you'd like to talk through how Visionify would fit your security requirements, schedule a demo and we'll bring the right people to the conversation.