UpClear | Security

Security

With ISAE 3402 Type 2 certification and enterprise-grade controls, we safeguard your business-critical revenue and spending data so you stay compliant, trusted and secure.

Security is a fundamental element of operations at UpClear. Robust security is critical to create and maintain the trust of our client partners. UpClear is committed to protecting your data.

UpClear and BluePlanner are ISAE 3402 Type 2 certified, an independent, third-party audit that validates internal controls to provides assurance that a vendor's internal controls are effective. It's an internationally recognized standard.

The goal of this certification is to provide assurance that the vendor has adequate internal controls in place related to the services they provide, especially services that impact the financial statements of their customers.

The "Type 2" distinction: The key difference between an ISAE 3402 Type 1 and a Type 2 report is the scope and period of the audit. The ISAE 3402 Type 1 Report is a snapshot from a point in time. It assesses the suitability of the design and implementation of the service organization's controls as of a specific date. It confirms that the controls are designed correctly and are in place. The ISAE 3402 Type 2 Report is a more comprehensive and rigorous report. It evaluates not only the design and implementation of controls but also their operating effectiveness over a period of time (typically 12 months).

An auditor performs detailed testing of the controls throughout this period to determine if they actually worked as intended and consistently achieved their objectives. This type of report provides a higher level of assurance to the vendor's clients because it demonstrates that the controls have been functioning effectively over time, not just at a single point.

ISAE vs. SOC

Prospective customers in the United States often ask whether UpClear holds a "System & Organizational Contols" or "SOC" certification.

"SOC" is a certification defined by the American Institute of Certified Public Accountants (AICPA). Because UpClear services clients internationally, we use an international certification. This is defined by the International Auditing and Assurance Standards Board or "IAASB." Their audit is called the "International Standard on Assurance Engagements" or ISAE. We are independently audited under ISAE 3402 Type II, the international standard for assurance over service organization controls, examined by an independent audit firm over a defined review period.

SOC and ISAE 3402 audits are not exactly the same, but are structurally similar and have the same objective. Both SOC and ISAE are third-party audited, both offer Type I (controls designed appropriately as of a point in time) and Type II (controls operating effectively over a period, typically 6–12 months) reports.

Your Data. Our Fortress.

Secure Password Policy Defined
Profiles & Permissions used in Role-Based Access Controls
Principle of Least Privildge Followed; UpClear Personnel get Minimum Necessary Access Rights
Single Sign-On Capability May be Utilized
Azure: UpClear Benefits from Built-in Security Features and Best Practices
Regular Vulnerability Testing