SOC 2 Type II

Overview

SOC 2 Type 2 is an independent attestation report issued by a CPA firm that evaluates whether a service organization’s controls relevant to the applicable Trust Services Criteria were suitably designed and operated effectively over a defined period of time. For Xano as a SaaS platform and data processor, this provides independent assurance regarding the design and operating effectiveness of controls within the scope of the examination. For customers evaluating Xano as a service provider, the SOC 2 Type 2 report can support vendor security reviews, risk assessments, and due diligence activities.

Scope of Xano’s Certification

Our SOC 2 report relates to the IT Consulting Services System and the suitability and operating effectiveness of the controls described throughout the period January 1, 2025, to December 31, 2025. Additional information regarding the examination scope, system boundaries, controls, and independent auditor testing is contained within Xano’s SOC 2 Type 2 report.

Trust Services Criteria (TSC):

• Security (Common Criteria)

How Xano Meets Compliance Criteria

Xano maintains a range of policies, procedures, and operational controls to support its compliance obligations and overall security posture. The examples below highlight key elements of our program in relation to this framework, and do not represent a complete list:

• Implemented access controls, MFA, and BYOD controls on all staff devices
• Access Control Policy
• Staff Onboarding & Offboarding Procedure
• Change Management Procedure
• Secure Software Development Life Cycle (SSDLC)
• Critical systems monitoring and alerts
• Incident Response Procedure
• Risk Assessment Procedure
• Management Reviews
• Backup & restoration testing, third-party penetration testing, third-party network testing
• Internal Audit Program

Our latest SOC 2 Type 2 Report is available for request below.