QNOPY Achieves SOC 2 Type II Compliance

At QNOPY, protecting our customers' data has always been a top priority. We're proud to announce that we have successfully achieved SOC 2 Type II compliance, demonstrating that our security, availability, and confidentiality controls meet the rigorous standards established by the American Institute of Certified Public Accountants (AICPA).

This milestone reinforces our commitment to providing a secure, reliable platform for environmental consultants, engineers, construction teams, and EHS professionals who rely on QNOPY every day.

What Is SOC 2 Type II?

SOC 2 is an independent audit that evaluates how organizations protect customer data through well-defined security controls.

Unlike a SOC 2 Type I report, which assesses controls at a single point in time, a SOC 2 Type II audit evaluates how those controls perform over an extended period. This provides customers with real-world evidence that our security practices are consistently followed not just documented.

What This Means for Our Customers

Organizations across more than 25 countries trust QNOPY to manage sensitive field data, laboratory results, project documentation, and compliance-critical information. Achieving SOC 2 Type II compliance provides independent verification that we maintain the security standards our customers expect.

This achievement reflects our commitment to:

• Robust security controls across our infrastructure, access management, and change management processes

• Tested and documented incident response, business continuity, and disaster recovery procedures

• Strict data classification and access control policies to ensure customer information remains protected

• A secure, vetted technology stack built on AWS with controlled use of platforms including GitHub, Microsoft 365, and customer support tools

• Continuous monitoring and ongoing evidence collection rather than one-time compliance activities

How We Achieved SOC 2 Type II

Achieving SOC 2 Type II required months of planning, implementation, testing, and independent validation.

QNOPY partnered with Roy & Associates as our independent auditor and utilized Strike Graph as our compliance management platform to streamline evidence collection and control monitoring throughout the audit process.

During this effort, our team developed and formalized a comprehensive security program that includes policies covering:

• Information Security

• Acceptable Use

• Change Management

• Incident Response

• Business Continuity & Disaster Recovery

• Data Management

• Data Classification

• Logical Access Control

In addition to documenting policies, we strengthened our operational security by improving access reviews, enhancing credential and encryption key management, expanding audit logging, and refining change tracking throughout our AWS infrastructure.

Security Is an Ongoing Commitment

SOC 2 Type II compliance is not a one-time accomplishment; it's an ongoing commitment.

At QNOPY, we continuously monitor our controls, perform regular access reviews, evaluate risks, and strengthen our security practices as our platform evolves. As we continue to grow, customers can remain confident that protecting their data will stay at the center of everything we build.

Learn More

If you'd like to learn more about QNOPY's security practices or request a copy of our SOC 2 Type II report, we'd be happy to help.

Contact our team today to discuss our security program and how QNOPY keeps your data protected.