What SOC 2 Type II tells a reviewer
SOC 2 is an audit framework from the American Institute of CPAs. A Type I report checks that controls are designed properly on one day. A Type II report checks that they actually worked over a period of months. It is the document a US vendor-risk review asks for first, because it answers most of a security questionnaire in one place, checked by an auditor rather than stated by the vendor.
Where Screenly stands
- 01
The report
SOC 2 Type II, covering all five trust services criteria. Request it from the trust center; it is shared under NDA, as SOC 2 reports usually are.
- 02
Alongside ISO/IEC 27001
Screenly is also certified to ISO/IEC 27001:2022, which covers the cloud platform, the software on the device, the APIs and support.
ISO/IEC 27001 - 03
What sits behind it
Screens that connect outbound only, devices with no remote login and signed updates, servers replaced every 24 hours, and accounts with no passwords. The security overview covers each one.
What else a review asks for
The documents that usually travel with a SOC 2 report, and where each one stands today.
| Topic | Where Screenly stands |
|---|---|
| ISO/IEC 27001 certificate | Yes, since August 2026, on request |
| Penetration test letter | No. The last published test is from November 2023 |
| SIG or CAIQ questionnaire | Not yet. We answer your questionnaire directly |
| List of sub-processors | Yes, on the sub-processors page |
| SBOM for the device software | Yes, for each release, in the trust center |
Questions
Does Screenly have a SOC 2 report?
Yes. A SOC 2 Type II report, audited against all five trust criteria.
Can we see the SOC 2 report?
Yes, under NDA. Request it from the trust center at trust.screenly.io.
Has Screenly had a penetration test in the last twelve months?
No. The last published test was in November 2023, by ControlPlane.
Is there a completed SIG or CAIQ questionnaire?
Not yet. We answer your questionnaire directly.