See It In Action
Talk To An Expert
Security & Trust

Built for the decisions CPA firms can't afford to get wrong

4impactdata protects the information your firm relies on with security and compliance built into the platform, not added on after the fact.

SOC 2 Type II
Trusted by CPA Firms & Outsourced Accounting Teams
AICPA SOC 2 Seal
SOC 2 Type II, Independently Audited to AICPA Standards
The AICPA is the national professional body and leading standard-setter for CPAs and the accounting profession. A SOC 2 Type II report evaluates how security controls operate over an extended period.
Enterprise-Grade Protection

Security designed into every layer

From infrastructure to storage, 4impactdata is built to protect the information your firm relies on at every step.

Infrastructure security

  • Unique production database authentication enforced
  • Access control procedures established
  • Firewall access restricted

Organizational security

  • Asset disposal procedures utilized
  • Anti-malware technology utilized
  • Code of Conduct acknowledged by contractors

Product security

  • Control self-assessments conducted
  • Vulnerability and system monitoring procedures established

Internal security procedures

  • Continuity and Disaster Recovery plans established
  • Continuity and Disaster Recovery plans tested
  • Cybersecurity insurance maintained

Data and privacy

  • Data retention procedures established
  • Customer data deleted upon leaving
  • Data classification policy established
Our Approach

Trust built into the platform, not added on after

Security, intelligence, and verification are treated as core parts of 4impactdata, not separate concerns.

01

Decision Intelligence, built in

4impactdata runs on a proprietary decision intelligence engine, built to help firms retain clients and grow revenue consistently, firm-wide.

02

Security by design

Access controls, system monitoring, and an independent SOC 2 Type II audit are part of how the platform is built, not steps added after the fact.

03

Verified, not just promised

Our Trust Center lets you review our controls and request our SOC 2 Type I and Type II reports, so our security posture is something you can verify for yourself.

Trust Center

Everything your security team needs, in one place

Our Trust Center gives your security, privacy, and procurement teams a place to review our controls and request our compliance documentation, ready for your next vendor review.

SOC 2 audit reports
SOC 2 Type I and Type II reports, available on request
Full control listing
Infrastructure, organizational, product, internal, and data & privacy controls
Policies & documentation
Additional resources available on request for active security reviews
FAQ

Security & Compliance

Straightforward answers to the questions teams ask us most.

General

Yes. The company has completed SOC 2 Type I and SOC 2 Type II audits. A SOC 2 Type II report evaluates how security controls operate over an extended period. Our full list of controls is available through our Trust Center, where you can also request our audit reports.

Beyond product security and data and privacy controls, the company maintains additional controls across infrastructure security, organizational security, and internal security procedures. Full details on these controls are available through our Trust Center, where you can also request audit reports and policies.

Product Security

The company performs control self-assessments at least annually to gain assurance that controls are in place and operating effectively. Corrective actions are taken based on relevant findings. If the company has committed to an SLA for a finding, the corrective action is completed within that SLA.

The company's formal policies outline the requirements for the following functions related to IT / Engineering:
  • vulnerability management;
  • system monitoring.
Data & Privacy

The company has formal retention and disposal procedures in place to guide the secure retention and disposal of company and customer data.

The company purges or removes customer data containing confidential information from the application environment, in accordance with best practices, when customers leave the service.

The company has a data classification policy in place to help ensure that confidential data is properly secured and restricted to authorized personnel.