Enterprise-grade security.
We protect your clients’ data, and your practice, with layered controls across the network, application, and infrastructure.
An independent auditor tested how our controls protect customer data over time, against criteria for security, availability, and confidentiality.
An international standard for information security management. Auditors review the controls that protect your data each year.
The same security posture, no matter your firm size.
A solo advisor with one plan gets the same SOC 2 Type II and ISO 27001 controls as a firm with hundreds, at no extra cost.
Why we chose Type II.
A Type I audit checks that controls exist. A Type II audit tests whether they operate effectively over months.
- Extended operational effectiveness testing
- Minimum multi-month observation period
- Validates controls work consistently over time
- Detailed evidence collection and testing
- Annual re-audits with continuous monitoring
- Ongoing compliance validation every 12 months
Focus: do the controls work effectively over time?
- Point-in-time assessment of security controls
- Evaluates design and implementation of controls
- Shorter audit period (typically a few weeks)
- Less comprehensive than Type II
Focus: are the right controls in place?
SOC 2 Type II gives stronger assurance because auditors test whether controls operate over an extended period. Annual re-audits and continuous monitoring keep testing the controls that protect sensitive 401(k) data.
An international standard for information security.
A systematic framework for managing sensitive information across people, processes, and technology, verified by independent auditors.
An international standard for information security management. It sets a structured approach to keeping company and customer data secure.
- Internationally recognized across 170+ countries
- Risk-based approach to security management
- Framework covering 114 controls
- Trust & credibility: Outside auditors check how we protect client data.
- Regulatory alignment: Aligns with widely recognized data-protection frameworks.
- Risk reduction: A defined process for finding and mitigating threats.
- Independent assurance: Accredited auditors assess our controls.
- Continuous improvement: Each annual audit feeds the next round of security fixes.
We protect plan and participant data with controls defined by an international standard.
Accredited auditors assess our security processes.
We follow documented incident-management procedures so we can respond fast to a security event.
Bottom line: An accredited auditor reviews our ISO 27001 controls each year.
A layered security framework.
Six layers of controls, from the network perimeter to backups.
- Virtual Private Cloud isolating the application
- Web Application Firewall on AWS
- HTTPS content delivery
- AWS S3 encryption at rest
- AWS S3 backup encryption in transit
- Database encryption at rest
- Application encryption at rest
- Parameterized queries to prevent SQL injection
- HTTP-only cookies
- Encrypted cookies with strict size limits
- Multi-factor authentication (MFA)
- JWT tokens
- Session management and revocation
- Role-based access control
- AWS CloudWatch observability
- Amazon Inspector automated vulnerability testing
- Regular security assessments and penetration testing
- Rate limiting on all API endpoints
- Regular automated backups
- Point-in-time recovery
- Documented disaster recovery process
- Geo-redundant backup storage
- Containerized Docker deployment
- Secure error handling
- AWS Secrets Manager integration
- Automated credential rotation
- Regular dependency updates
Independently audited, reviewed each year.
We completed a SOC 2 Type II audit and hold ISO 27001 certification. Independent auditors assess our security, privacy, and data-protection practices and review them over time.
Apply for early access.
We're onboarding advisory firms now. Apply and we'll reach out, usually within one business day.