Our SOC 2 Type II report
| Report | SOC 2 Type II |
|---|---|
| Trust Services Criteria | Security (Common Criteria) |
| Period examined | 16 September 2025 to 15 September 2026 |
| Scope | The Streamoid platform, including Artifax, Photogenix and Catalogix |
| Examined by | An independent service auditor, under AICPA attestation standards |
| Availability | Shared with customers and prospects under NDA |
What SOC 2 means
SOC 2 is an independent examination, defined by the American Institute of Certified Public Accountants (AICPA), of how a service provider protects the data it handles for its customers. An independent auditor tests the provider's controls against the AICPA Trust Services Criteria and issues a report with its opinion.
SOC 2 is a report, not a certificate. The report describes the controls in detail, the tests the auditor performed and what those tests found, which is why customers ask to read it rather than rely on a logo.
| Type I | Type II | |
|---|---|---|
| What is tested | Whether controls are designed appropriately | Whether controls are designed appropriately and actually operated effectively |
| Over what time | A single point in time | An observation period, typically several months to a year |
| What it tells you | The right controls exist | The controls worked, day to day, across the whole period |
Streamoid's report is Type II: the auditor tested our controls in operation across a twelve-month period, from 16 September 2025 to 15 September 2026.
What our report covers
The AICPA defines five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality and Privacy. Security is the foundation of every SOC 2 report, and it is the criterion our report covers.
Security
Systems and data are protected against unauthorised access, disclosure and damage. The Security criteria, also called the Common Criteria, span governance and ethics, risk assessment, monitoring, logical and physical access, system operations and incident response, change management, and vendor risk.
The Streamoid platform
The examination covers Streamoid's AI-powered platform for fashion and lifestyle brands, including Artifax for product design, Photogenix for product imagery and Catalogix for catalog enrichment and marketplace listings. The report's system description sets out the exact boundaries.
How we protect your data
Encryption
Data is encrypted at rest with AES-256 or equivalent and in transit with TLS 1.2 or higher. Server access uses SSH public-key authentication or authenticated HTTPS sessions, and company laptops are disk-encrypted.
Access control
Every person has a unique account, and access is granted on request with approval from the relevant owner. Privileged access is restricted to defined roles, requires multi-factor authentication, and is reviewed and revalidated by management. Access is removed promptly when someone leaves.
Infrastructure and disaster recovery
Production runs in data centres whose provider's own ISO/IEC 27001 certificate and SOC 2 report we review every year, with networks protected by firewalls and development, test and production kept in separate environments. Business continuity and disaster recovery plans are tested at least annually, including failover and backup restoration.
Monitoring and incident response
Logs are monitored to detect unusual activity and logon attempts. A documented incident response plan governs how security incidents are reported, tracked to closure and resolved, and management reviews major changes and the root cause of incidents twice a year.
Vulnerability management
An external vendor performs vulnerability scans and penetration testing every year, and findings are tracked to resolution. Security patches are applied regularly to critical servers and workstations, and every workstation runs up-to-date antivirus software.
Change management
Changes are approved before work starts, assessed for their impact, and tested before release. The people who write or approve a change do not deploy it to production, and direct commits to production branches are restricted.
People
Everyone at Streamoid passes a background check before joining, signs a non-disclosure agreement and our code of conduct, and completes security awareness training when they join and every year after.
Vendors and governance
Vendors are assessed every year and sign agreements that include security commitments. A formal risk management programme, reviewed by management annually, and an annual internal audit keep our controls current.
Request our SOC 2 report
Our SOC 2 Type II report is available to customers and prospective customers under a non-disclosure agreement. Email support@streamoid.com from your company address and tell us which organisation you are with. We can also help with security questionnaires and vendor reviews.
Reporting a vulnerability
If you believe you have found a security issue in a Streamoid product or website, email support@streamoid.com with the details and steps to reproduce it. Please give us reasonable time to investigate and fix it before you disclose it publicly.