Trust and Security
Your data is in careful hands.
Our people work inside client environments and handle financial and operational data. Acamar Consulting completed a SOC 2 Type 1 examination by an independent CPA firm, covering the Security, Availability and Confidentiality criteria. Request the full report below.
Request the SOC 2 report
The examination
What the report covers
Independent examiner
Sensiba LLP, a CPA firm based in San Jose, California, performed the examination and issued its opinion on November 3, 2026.
Three criteria
Security, Availability and Confidentiality, applied to Acamar Consulting's professional services.
Type 1 as of October 22, 2026
A Type 1 report gives the auditor's opinion on the design of our controls as of that date. Every control tested was found suitably designed.
Controls summary
How we protect client information
A summary of the controls described in our report. The report holds the complete control descriptions and the auditor's opinion.
Access control
- Multi-factor authentication or equivalent across in-scope systems
- Individual user accounts for systems holding customer data
- Management approval before new-hire access is provisioned
- Timely access removal when someone leaves
- Access reviews at least quarterly, with privileged access limited to authorized personnel
Data protection
- Disk encryption required on workstations
- Critical data encrypted at rest
- Documented encryption and key management requirements
- A register of confidential data and where it is stored
- Defined data disposal guidelines, with data erased before assets are retired
Monitoring and endpoints
- Antivirus on workstations
- Operating system updates monitored and patches applied on release
- Automated alerts and log reviews for suspicious account activity
- A documented vulnerability management program
Incident response and continuity
- Documented incident management and response plans, reviewed at least annually
- Root cause analysis for high severity incidents
- Business continuity and disaster recovery plans, tested annually
- A backup policy covering backups and recoverability
People
- Background or reference checks before employment
- Security awareness training at least annually
- A code of conduct with enforcement procedures
- Documented job descriptions and role responsibilities
Risk, vendors and governance
- Risk assessments at least annually, including the potential for fraud
- An annual vendor risk assessment and annual review of vendor attestation reports
- Policies reviewed at least annually, with governance reviews of controls monthly
- Documented change control procedures
Our report does not cover data storage services provided by Microsoft, which we use as a subservice organization. We review Microsoft's SOC 2 reports as part of our vendor risk program.
Request the report
Get a copy of our SOC 2 report.
The report is confidential and available to current and prospective customers and business partners. Tell us who you are and we will follow up by email.