Fluid Attacks SOC 2 Type II: Three consecutive annual reports, with ISO 27001, PCI DSS, and GDPR

More than a milestone

This achievement is a source of pride for several reasons: the timing, the supporting technology, the internal improvements it required, and the standard it sets for the future. Just as important, Fluid Attacks sees this result as the beginning of a new stage rather than the end of a project. The real challenge now is to sustain the management system, help it evolve, and keep raising the rigor of the company's operations.

That is the real significance of assurance work when it is done well. Trust frameworks should not function as decorative labels. They should force better decisions: sharper scope definition, clearer control ownership, stronger evidence practices, better documentation, and more resilient operating habits that reflect self-regulation, maturity, and institutional discipline. In this cycle, that is exactly what happened.

Fluid Attacks compliance at a glance

Three consecutive years of SOC 2 Type II

Fluid Attacks has obtained a SOC 2 Type II report every year since 2024.

What Fluid Attacks achieved, precisely

When communicating about compliance and assurance, precision matters: ISO 27001 and 27701 are certifications; ISO 27017 and 27018 are complementary standards to ISO 27001 and are best described publicly as controls aligned with ISO 27001 and 27701; SOC 2 is an attestation; GDPR is a matter of compliance with legal requirements; and PCI DSS is a validation.

ISO 27001, ISO 27701, ISO 27017, and ISO 27018

Within that framework, Fluid Attacks achieved ISO/IEC 27001:2022 and ISO/IEC 27701:2019 certification for its information security and privacy management system. The certificate was issued by Kompleye Attestation LLC, which audited the system and confirmed that it met the requirements of the relevant standards. This certificate records an original registration date of February 25, 2026, with an expiration date of February 24, 2029.

The registration record for ISO/IEC 27017:2015 and ISO/IEC 27018:2019 shows the same dates. Conformity with these latest ISO standards demonstrates Fluid Attacks’ alignment with standard cloud security configurations and the protection of personally identifiable information (PII) in cloud services.

SOC 2 Type II and SOC 3

Fluid Attacks also obtained a SOC 2 Type II attestation and a SOC 3 report, both for the period July 1, 2024 to June 30, 2025, with Kompleye as the independent service auditor. The SOC 2 report evaluates the design suitability and operational effectiveness of security-related controls for Fluid Attacks’ application security (AppSec) solutions.

The SOC 3 report covers the same period and offers a public-facing assurance statement on the effectiveness of those controls without disclosing the sensitive details contained in the SOC 2 report. In 2026, A-LIGN issued the third SOC 2 Type II report (July 1, 2025 to June 30, 2026).

PCI DSS v4.0.1

For payments, Fluid Attacks achieved PCI DSS v4.0.1 validation through an Attestation of Compliance tied to Self-Assessment Questionnaire A-EP, with Internet Security Auditors (IsecAuditors) acting as the qualified security assessor.

The result recorded an overall COMPLIANT rating. The payment model described in the documentation is intentionally narrow: cardholder data is captured by PCI-compliant third-party payment providers, and Fluid Attacks’ systems do not themselves store, process, or transmit raw account data.

GDPR

In parallel, the company documented and strengthened privacy controls and governance structures that support GDPR compliance, including a Privacy Information Management System, a Record of Processing Activities, data subject rights procedures, a designated Data Protection Officer, breach-notification commitments, subprocessor governance, and privacy-by-design practices.

Why this mix of frameworks matters

Each of these frameworks addresses a different dimension of trust, but in practice, they reinforce one another to form a more coherent assurance model:

• ISO/IEC 27001 establishes the management system for information security. It requires an organization to identify risks, define controls, assign responsibilities, and operate a structured continuous-improvement program. ISO/IEC 27701 extends that logic into privacy, adding requirements relevant to how organizations process personal data as controllers and processors. ISO/IEC 27017 and 27018 add cloud- and privacy-specific control guidance.
  
  

• SOC 2 Type II provides third-party assurance that controls are not only well designed but also operating effectively over time — a time-bound operational validation that is especially valuable for customers who want evidence that security commitments are reflected in day-to-day practice. SOC 3 complements it by providing a high-level assurance statement for broader public audiences.
  
  

• PCI DSS focuses specifically on protecting payment card data and the systems and processes that support payment transactions. GDPR, meanwhile, is not a certification framework at all, but a legal regulation that governs how organizations handle personal data and protect individuals’ rights.

Together, these frameworks form a layered model of trust: governance, operational assurance, privacy accountability, payment security, and legal compliance working in combination rather than isolation.

That complementarity was also a key enabler of the integrated audit itself. As Diego notes, the auditors used a strategic approach to map and reuse evidence across overlapping requirements in ISO 27001, SOC 2, GDPR, and related frameworks, reducing redundant testing, lowering administrative burden, and saving time without weakening rigor.

The providers behind the achievement

Trust in assurance depends not only on what a company says it achieved, but also on who evaluated it and under what accreditation model. Fluid Attacks completed this work with the support of three key providers: Vanta, Kompleye, and IsecAuditors. Each played a different role in the assurance chain.

Vanta served as the compliance automation platform behind the effort. It was not the auditor, but it was essential to making the project manageable. Notably, Vanta adopted one of Fluid Attacks’ recommendations for handling audits spanning multiple frameworks — a detail that underscores just how unusual this project was. As Diego points out, Vanta streamlined the work by integrating with tools that monitor security controls, ensure documents stay up to date, and provide auditors with access to evidence. In practice, that meant centralizing evidence collection, reducing manual work, and helping the team reuse control information across multiple frameworks.

Kompleye fulfilled two distinct roles. For SOC, it acted as the independent service auditor, evaluating controls against the AICPA Trust Services Criteria and issuing the formal attestation reports. For the 2026 SOC 2 Type II report, A-LIGN acted as the independent service auditor. For ISO, Kompleye Attestation LLC acted as the certification body, auditing the management system and issuing the certificates. That distinction matters because “attestation” and “certification” are not interchangeable terms. Kompleye’s ISO activity is backed by ANAB accreditation, which means the certification body itself is subject to external oversight. That additional layer of verification strengthens the credibility of the certificates issued under its authority.

IsecAuditors led the PCI DSS portion of the project as the qualified security assessor. That role exists within the PCI Security Standards Council ecosystem specifically to ensure that PCI validations are carried out by independent firms with the competence and authorization to assess whether the payment environment and controls meet the requirements for the applicable SAQ and to issue a formal validation of compliance. In this engagement, Isec handled the PCI side while Kompleye handled SOC and ISO, allowing Fluid Attacks to pursue an integrated assurance structure rather than a fragmented one.

How the project unfolded

The effort was ambitious from the start. According to Diego, the selection phase involved evaluating providers’ capabilities and experience. The directive was clear: find a provider arrangement capable of supporting an integrated audit cycle, not just a series of disconnected assessments. That structure emerged through Isec and its partner Kompleye, with Vanta supporting day-to-day compliance operations.

Another early challenge was defining the certification scope, which had to be narrowed into something rigorous and manageable. The final scope focused on the secure provision of the Essential and Advanced plans, including the related processing of personal data — a choice that improved focus and feasibility without diluting the certification’s value.

Regarding PCI, determining whether the appropriate self-assessment path was SAQ A or SAQ A-EP required technical and contractual analysis and caused delays. This was not a trivial distinction. The questionnaire had to reflect the actual architecture, the flow of payment information, and the distribution of responsibilities between Fluid Attacks and third-party payment providers.

Once execution began, internal collaboration became one of the strongest drivers of success. The collaborators involved in the audit interviews helped keep the process flowing. At the same time, the internal audit phase exposed a common weakness in certification programs that is often underestimated: documentation gaps. Finally, not every framework demanded the same kind of effort. This contrast illustrated how a single integrated project can simultaneously address both the recertification of established systems and the development of first-cycle ones.

What improved inside Fluid Attacks

One of the strongest outcomes of this project is that it changed internal practices, not just external status. The team became more disciplined in how it collected, preserved, and mapped evidence. Scope-setting became more strategic. And the company improved its ability to reuse validated evidence across multiple standards, rather than handling each framework in isolation.

The audit cycle also reinforced an important organizational reality: meaningful compliance cannot be fully outsourced. Tools, auditors, and accreditation matter, but none of them can replace internal ownership. Leaders and team members still have to actively participate in interviews, provide evidence, answer hard questions, and take responsibility for the controls in their areas. Diego makes this especially clear: integrated certification efforts of this magnitude require the organization itself to take an active coordinating role rather than leaving the process structure entirely to vendors.

That internal ownership is part of what makes this milestone meaningful. It demonstrates not only that Fluid Attacks passed external evaluations, but that it strengthened the habits and systems needed to sustain assurance over time.

Lessons learned

Several lessons from this effort stand out and are worth keeping visible for future cycles:

• Define the scope strategically before the audit begins. The scope can be expanded gradually, following a set of priorities, without attempting to cover all aspects from the outset.

• Perform internal audits with the same rigor as external ones. A weak internal report undermines both program readiness and credibility.

• Treat experience with GRC (governance, risk management, and compliance) automation platforms as an explicit vendor-selection criterion. In multi-framework projects, the supporting technology shapes how efficiently evidence can be collected, mapped, and reviewed.

• Identify and remediate documentation gaps early. They are among the most frequent and controllable risks in ISO certification efforts.

• Secure active participation from the leaders and individuals responsible for scoped processes, especially during interviews and evidence collection.

•  Keep evidence collection running between audits. SOC 2 Type II renews every year, and Fluid Attacks has now completed three cycles. Its security controls are listed in the Trust Center.

How to verify our certifications and request the SOC 2 report

The Trust Center lists every report and certificate. The SOC 3 reports and the GDPR document are public. Other documents need access, and each one is marked. Request the SOC 2 Type II report with the Request access form; it is shared under an NDA.

The harder part starts now

Achieving these certifications, attestations, validations, and alignments is a significant milestone for Fluid Attacks as an AppSec company. But the crucial objective moving forward is to maintain them — sustaining the management system, preserving evidence quality, continuing to refine policies and controls, and upholding the commitment to security with the level of rigor that made this milestone possible.

Trust is not built by publishing a list of frameworks. It is built by doing the work required to earn them, by choosing independent and accredited evaluators, by improving internal discipline, and by maintaining that standard once the audit cycle ends. Fluid Attacks has now raised the bar. The next challenge is to maintain it and potentially adopt future frameworks to further strengthen the way the company operates.

If you’re interested in checking out our certification and accreditation reports, we invite you to visit our Trust Center. See also our certifications and compliance solutions.

Frequently asked questions

Does Fluid Attacks have SOC 2 Type II?

Yes. The latest report covers July 1, 2025 to June 30, 2026 and was issued by A-LIGN.

For how many consecutive years has Fluid Attacks held SOC 2 Type II?

Three: 2024, 2025, and 2026.

Who audited the SOC 2 Type II reports?

A-LIGN (2026), Kompleye (2025), and Insight Assurance (2024).

SOC 2 Type II or SOC 3: what is the difference?

SOC 2 details controls and tests, with restricted use. SOC 3 is a short public summary.

Can one audit cycle cover SOC 2, ISO 27001, and PCI DSS?

Yes. Auditors reuse evidence across overlapping requirements.

How can a customer request the SOC 2 report?

Use Request access in the Trust Center. It is shared under an NDA.