Why NEO uses SOC 2-audited hosting providers

SOC 2 is an auditing standard created by the American Institute of Certified Public Accountants. An independent auditor examines a company's controls for security, availability and confidentiality, and reports on whether they work as described over a period of time.

The providers we use

• Vercel runs the website and client portal.
• Google Cloud hosts the client database, in its Toronto region.
• Supabase provides private, encrypted storage for documents.

Each publishes information about its SOC 2 reports for its customers.

What this means, and what it doesn't

The audits cover the providers' infrastructure: their data centres, staff access, monitoring and incident response. NEO itself is a small firm and has not been SOC 2 audited. Our own safeguards, such as limited access to files, sign-in for every user, encryption, and our professional duty of confidentiality, sit on top of the providers' controls.

Why it matters

Choosing audited providers means the systems underneath your file are run to a recognized standard, with independent checks, rather than on a single office computer.

How NEO encrypts your information

Read next: How NEO follows Canada's Anti-Spam Legislation (CASL)

Photos from Pexels: A laptop showing a cybersecurity message · Working on documents and a laptop.

This article is general information for people in Ontario, not legal advice. Rules, forms and deadlines change, and every situation is different. Check the current rule or speak to a licensed legal professional before you act.