Compliance
1. What SOC Binder does for your audit
SOC Binder collects and organizes evidence for SOC 1 and SOC 2 examinations: it checks your cloud configuration on a schedule, keeps a dated history an auditor can sample, tracks the parts of a programme no API can see, and lets you share all of it with your auditor through a read-only link.
It is not a CPA firm and issues no opinion. Only an independent licensed CPA firm can examine your controls and issue a SOC report, and nobody can make you “SOC 2 certified” — SOC 2 is an attestation report, not a certificate. See our Terms of Service, section 2.
ISO 27001, HIPAA and GDPR
These are offered as mappings onto the same evidence, not as separate audits. Each requirement — an ISO 27001 Annex A control or management-system clause, a HIPAA Security Rule safeguard, a GDPR article — points at the control activities SOC Binder already tracks for SOC 2, so evidence collected once counts toward each. A requirement’s status is rolled up from those activities:
- Met — every activity it points at is met, and together they cover the whole requirement.
- Partly met — some are met, or all are but the requirement also needs something they do not cover; it says what.
- Not met yet — it has activities behind it and none is met.
- Not covered yet — nothing here covers it. It is never counted as met, and it says what evidence would satisfy it.
Today the mapping reaches 98 of 106 ISO 27001 requirements, 45 of 49 HIPAA requirements and 26 of 29 GDPR requirements. Requirement names are our own short descriptions: ISO’s text is copyrighted and not reproduced, and HIPAA and GDPR are cited by section and article. A mapping is our judgement, not your auditor’s; it shows where the evidence is, and the assessor decides whether it is enough. SOC Binder is not an ISO certification body, there is no official HIPAA certification, and nothing here is legal advice on GDPR.
2. Our role under privacy law
For the evidence and records your organization keeps in SOC Binder, your organization is the controller (GDPR) or business (CCPA), and RuneSpoke Inc. is its processor or service provider, acting only on its instructions. For your own account details we are the controller. Our Privacy Policy sets out both.
3. GDPR and UK GDPR
- We process personal data only to provide the service, and only as your organization instructs for Customer Data.
- We help you answer data-subject requests for access, correction, erasure, restriction, portability and objection.
- Our subprocessors are listed publicly, and we give notice before adding one.
- Data is hosted in the United States (AWS US East (Ohio), us-east-2). International transfers rely on the EU Standard Contractual Clauses and the UK Addendum.
- We notify affected customers without undue delay after becoming aware of a personal data breach.
4. CCPA / CPRA
- We do not sell personal information, and do not share it for cross-context behavioral advertising.
- As a service provider we use Customer Data only for the business purposes in our agreement with you, and do not combine it with data from elsewhere.
- We help you respond to consumer requests to know, delete and correct.
5. Data Processing Addendum
If your organization needs a Data Processing Addendum — most do before putting personal information into a vendor’s system — email legal@socbinder.com and we will send ours for signature. It includes the Standard Contractual Clauses for transfers from the EEA, UK and Switzerland.
6. Retention and deletion
Retention periods are stated precisely in section 7 of our Privacy Policy rather than summarized here, so there is one version of them.
7. Our own SOC 2
RuneSpoke Inc. has not yet been through a SOC 2 examination and does not claim to hold a report. We are working toward one, and our current security practices are on our Security page.
8. Contact
Privacy, data protection and compliance: legal@socbinder.com.