Augmentt has completed its annual SOC 2 Type 2 audit and renewed the attestation we first earned in 2022. An independent auditor looked at the controls that protect the Augmentt platform. They checked that those controls were designed well and that they actually ran throughout the audit period.
When you connect a client tenant to Augmentt, you give us delegated access to that client’s Microsoft 365 environment. An attacker would value that access, so we hold our own environment to the standard you’d expect from any vendor in your stack, and we pay an outside firm to check our work every year.
What the Type 2 report tests
A SOC 2 Type 1 report checks that controls are designed correctly on one date. A Type 2 report covers a full audit window, which is 12 months for us. The auditor samples evidence from across that window to confirm the controls worked in practice. Our report is scoped to the AICPA Security trust services criteria and covers the Augmentt platform, which runs on Amazon Web Services.
The examination covers nine control areas. They range from the control environment and risk assessment to logical access, system operations, and change management. Each control is tested, and the results appear in the report.
Our 2026 SOC 2 Audit covers all 5 of the Trust Service Criteria (TSCs) for SOC 2; Security, Privacy, Process Integrity, Availability and Confidentiality. These TSCs are the foundation for the 116 organizational controls, and 163 tests of those controls that help us ensure that yours and your customers data is being protected.
What happens between audits
An annual audit shows how our controls performed last year. To catch problems as they happen, we use Vanta to monitor our SOC 2 controls continuously. Vanta connects to Microsoft Entra ID, Intune, Defender, GitHub, and AWS, and it brings in findings from our independent penetration tests. Intune reports device posture for every company computer, including disk encryption, screen lock, and antivirus status. If a control drifts in March, we see it in March. A named security officer owns the program and works through the findings.
Read the report yourself
You don’t have to take our word for any of this. The Augmentt Trust Center at trust.augmentt.com holds the current SOC 2 report and our pen test summaries. Request access there, and you can review the evidence before you connect a tenant. You can also keep it on file for the next time a client’s auditor or cyber insurer asks how you vet your vendors.
