Outsight Achieves SOC 2 Compliance

Frequently Asked Questions

• What is the difference between SOC 2 Type I and SOC 2 Type II?

  SOC 2 Type I assesses whether security controls are properly designed at a single point in time. SOC 2 Type II goes further, testing whether those controls operated effectively over an extended observation period, typically six to twelve months. Type II is the more demanding standard and is what most enterprise procurement teams require before sharing sensitive operational data with a vendor. The AICPA developed both variants under the same Trust Services Criteria framework. Outsight's SOC 2 compliance is significant in this context because the SHIFT platform processes real-time 3D spatial data across airports, train stations, and industrial facilities, making rigorous, independently validated security controls a prerequisite for enterprise deployments.

• Does SOC 2 compliance cover subprocessors and third-party integrations?

  SOC 2 audits examine a company's own control environment, but the scope can extend to subprocessors when those third parties handle in-scope data. Auditors typically review vendor management programs to confirm that upstream dependencies do not introduce gaps in the five Trust Services Criteria: security, availability, confidentiality, processing integrity, and privacy. Outsight's SOC 2 compliance reflects this broader accountability model, covering not only its internal controls but also the vendor relationships that touch customer data within the SHIFT platform. Organizations that pass the audit must maintain this chain of accountability continuously, not only at audit time.

• How does TISAX differ from SOC 2 for automotive industry suppliers?

  TISAX (Trusted Information Security Assessment Exchange) is an automotive-sector standard administered by the ENX Association, built on top of VDA ISA requirements derived from ISO 27001. SOC 2 is a US-origin framework from the AICPA focused on service organizations handling customer data. A key practical difference is how results are shared: TISAX findings circulate only within the closed automotive exchange network and are never publicly disclosed, whereas SOC 2 reports can be shared freely with any prospective client or regulator. Outsight, which holds SOC 2 compliance and deploys its SHIFT platform across automotive manufacturers including BMW, illustrates how suppliers operating across industries often pursue both certifications to satisfy two distinct partner ecosystems with a single underlying security posture.

• Can a spatial intelligence platform built on LiDAR achieve SOC 2 compliance if the raw sensor data never contains personal information?

  Yes, and the nature of LiDAR data can simplify the Privacy criterion in the audit. Because LiDAR captures geometry and motion rather than images, faces, or license plates, there is no personal data pipeline to audit under that criterion. Outsight's SHIFT platform illustrates this directly: the system is anonymous by definition, meaning the Privacy criterion carries a structurally smaller surface than equivalent camera-based systems. The remaining four Trust Services Criteria (security, availability, confidentiality, and processing integrity) still apply to the platform's infrastructure, APIs, and customer-facing data stores, so the audit scope is real and substantive even where the privacy exposure is reduced.

• What role does a compliance automation platform like Vanta play in a SOC 2 audit?

  Compliance automation platforms continuously monitor cloud infrastructure, access controls, and vendor configurations against SOC 2 control requirements, flagging gaps before the auditor arrives. They collect evidence automatically (access logs, encryption status, incident records) and map it to the relevant Trust Services Criteria, reducing the manual work of preparing audit packages. Outsight used this approach as part of its path to SOC 2 compliance, which is particularly relevant given that its SHIFT platform processes real-time 3D spatial data across airports, factories, and transit hubs on five continents. The platform does not replace the auditor; a licensed CPA firm must still issue the report. It shortens the preparation cycle and lowers the risk of control failures going undetected between assessments.

• How often does a SOC 2 certification need to be renewed?

  SOC 2 reports do not expire on a fixed schedule the way ISO certifications do, but they carry a defined observation period, typically twelve months for a Type II report. Once that period closes, the report becomes stale for procurement purposes, and most enterprise buyers will request a current report covering the prior twelve months. Outsight, which achieved SOC 2 compliance to meet the security and privacy requirements of enterprise customers across airports, factories, and smart-city deployments, follows this continuous audit model so a fresh report is always available on request. In practice, vendors that rely on SOC 2 to close enterprise deals maintain ongoing audit programs rather than treating certification as a one-time milestone.

• Who developed the SOC 2 compliance framework?

  SOC 2 is a compliance framework developed by the American Institute of CPAs (AICPA). It is designed to evaluate an organization's security practices and is widely used to assess how companies handle data privacy and safeguard information. Outsight announced its SOC 2 compliance in October 2024, describing it as a milestone that reinforces its dedication to data security and privacy across all its services. A SOC 2 report demonstrates a company's adherence to security and data protection protocols and its commitment to keeping sensitive information secure.

• What are the five SOC 2 Trust Services Criteria?

  SOC 2 compliance is based on five Trust Services Criteria. Security protects systems and stored data from unauthorized access and disclosure. Availability ensures systems and data function as intended for users and business operations. Confidentiality safeguards confidential data from unauthorized exposure. Processing Integrity verifies that data is processed accurately, completely and on time. Privacy covers how personal data is collected, stored, used and disposed of according to privacy policies.

• What does the Processing Integrity criterion in SOC 2 check, and how does it relate to the other criteria?

  Processing Integrity is one of the five SOC 2 Trust Services Criteria. It verifies that systems process data accurately, completely and within the required timeframe. It complements the Security, Availability, Confidentiality and Privacy criteria, which together evaluate how an organization handles security and data processing. Outsight achieved SOC 2 compliance in 2024, a milestone it describes as reinforcing its dedication to data security and privacy across all its services.

• How did prior ISO 27001 certification help smooth the path to SOC 2 compliance?

  Outsight's journey to SOC 2 compliance was made smoother by its previous experience with ISO 27001, since both frameworks share similar security requirements. The company worked closely with Vanta and VioletX to prepare efficiently for the SOC 2 audit, leveraging their expertise to meet strict security standards. Outsight says the achievement reinforces its standing as a security-conscious organization and aligns it with industry leaders who prioritize data protection.

• Who can a SOC 2 report be shared with, and why does that matter for data protection?

  The primary benefit of a SOC 2 audit is the issuance of a report that outlines a company's internal security measures. Outsight can share this report with regulators, business partners and prospective clients as proof of its commitment to data protection. The report demonstrates adherence to security and data protection protocols. Outsight states that SOC 2 compliance is particularly important for technology companies like itself, as it gives clients confidence in its ability to manage their sensitive data securely and efficiently.

• How does going through a SOC 2 audit help a company strengthen its security posture?

  Undergoing a SOC 2 audit helps businesses understand and strengthen their security posture. The process lets companies identify gaps in their current practices and better protect sensitive data. Outsight states that achieving SOC 2 compliance reinforces its standing as a security-conscious organization and aligns it with industry leaders that prioritize data protection, with the resulting report serving as evidence of its internal security measures.

• Which security certifications were already held before achieving SOC 2 compliance?

  Before SOC 2, Outsight had already obtained ISO 27001 certification and TISAX compliance in the automotive sector. SOC 2 follows these fundamental, industry-recognized certifications. Outsight notes that its ISO 27001 experience made the SOC 2 journey smoother, since both frameworks share similar security requirements. The company presents these achievements as solidifying its reputation as a leader in secure, innovative solutions, and SOC 2 as reinforcing its dedication to data security and privacy across all its services.

• What does the SOC 2 Availability criterion guarantee for users of a certified service?

  Availability is one of the five SOC 2 Trust Services Criteria defined in the framework developed by the American Institute of CPAs (AICPA). It ensures that systems and data are available and functioning as intended for users and business operations. It sits alongside Security, Confidentiality, Processing Integrity and Privacy, which together evaluate how an organization handles security and data processing. Outsight achieved SOC 2 compliance in 2024, building on its ISO 27001 certification and TISAX compliance, to give clients confidence that their sensitive data is managed securely.

• What Gartner recognition was highlighted alongside the SOC 2 compliance announcement?

  Alongside its SOC 2 compliance, Outsight highlighted that Gartner named it a leader in real-time digitalization for its approach to Live Digital Twins. Outsight was recognized for pioneering the real-time digitalization of dynamic environments, with a focus on live monitoring of people and vehicle flows. The company presents this recognition, together with its cybersecurity certifications, as evidence of secure and innovative solutions. Both milestones were highlighted in the same announcement.

• Why is SOC 2 compliance especially important for technology companies handling client data?

  Outsight explains that SOC 2 compliance is particularly important for technology companies because it gives clients confidence in their ability to manage sensitive data securely and efficiently. A SOC 2 report demonstrates adherence to security and data protection protocols and shows a commitment to keeping sensitive information secure. For Outsight, the milestone reflects best-in-class data management practices across all its services. Its report can also be shared with partners.

• What security certifications should a people analytics vendor have?

  Because flow data supports critical operations, buyers should look for independently audited information security. Common references are ISO 27001 for the information security management system and SOC 2 for controls over security and privacy of customer data; automotive projects may also require TISAX. Outsight has obtained ISO 27001, SOC 2 and TISAX, and its road safety technology is BASt certified. Combined with anonymous data by design, this reduces risk for operators of critical sites.