Summary Korbyt has completed its SOC 2 Type II audit for the fifth consecutive year. An independent auditor tested our security controls over time, and our commitment to protecting customer data has not changed.
Korbyt has completed its SOC 2 Type II audit for the fifth consecutive year, and our commitment to security remains the same. SOC 2 Type II is an independent audit that tests whether a company’s security controls work as intended over a full period of time, not just on a single day.
Our customers rely on Korbyt Anywhere to run digital signage, space booking, and workplace communications across their organizations. They trust us with company data every day, and they need proof that trust is earned. Five years of Type II compliance, verified each year by an independent third party, is that proof.
Here is what the audit covers, how we keep the standard high all year, and what it means for your team.
What is SOC 2 Type II compliance?
SOC 2 is a reporting framework from the American Institute of Certified Public Accountants (AICPA). An independent CPA firm evaluates a company’s controls against the Trust Services Criteria, which cover security, availability, processing integrity, confidentiality, and privacy. The AICPA describes SOC 2 as a way to give customers and business partners information about those controls.
A Type I report looks at controls at a single point in time. A Type II report tests whether those controls operated effectively over a period, which makes it the stronger signal for customers.
This year’s audit covered September 2025 through August 2026. Korbyt’s audit scope includes security, availability, and confidentiality.
“The SOC 2 audit is based on the Trust Services Criteria,” said Joseph Kirkpatrick, President of KirkpatrickPrice. “Korbyt delivers trust-based services to their clients, and by communicating the results of this audit, their clients can be assured of their reliance on Korbyt’s controls.”
How did Korbyt score on penetration testing?
Beyond the SOC 2 audit, Korbyt brings in independent testers to probe our network and applications, so we can find and fix weaknesses before they ever affect customers.
Here is how we scored this year:
Network Penetration Test: Our network earned an A+, the top rating, showing strong protection across every point an attacker could target.
Application Penetration Tests: Testers found no significant vulnerabilities in Korbyt Booking or Korbyt Signage, and both applications received an A rating.
Taken together, these scores show that Korbyt’s security goes beyond industry benchmarks. Customers can be confident their workplace experience platform is built to be secure and stays secure in daily use.
How does Korbyt protect data all year?
An audit happens once a year. Security work happens every day. Our practices include:
- Encryption: data is encrypted in transit and at rest.
- Data separation: each customer’s data is kept in its own tenant database.
- Access control: multi-factor authentication (MFA) and role-based access control (RBAC, which lets admins set access by role).
- Least privilege: employees get only the access their job requires.
- Training: all employees complete annual information security training.
- Monitoring: our security team watches the platform around the clock with intrusion detection.
See the full picture on our Korbyt security page.
What does this mean for Korbyt customers?
Your vendors handle your data, so their security becomes part of yours. A current SOC 2 Type II audit gives your IT, security, and procurement teams independent evidence for vendor reviews, so you do not have to rely on our word alone.
It also lets your teams focus on communicating with employees, guests, and customers instead of worrying about the platform behind it.
Security is a habit, not an event
Five years of SOC 2 Type II compliance reflects a simple idea: security is something we practice daily, and the audit confirms it once a year. As threats evolve, our standards will keep pace, so you can keep your focus on your people and your business.
Ready to see Korbyt in action? Talk to an expert about our security practices.
FAQs
Answers to common questions about SOC 2 compliance and what it means for Korbyt customers.
It means an independent auditor tested a company’s security controls over a set period and found them operating effectively. It is based on the AICPA’s Trust Services Criteria.
Type I reviews whether controls are designed properly at one point in time. Type II tests whether they worked over a longer period.
Every year. This is our fifth consecutive year of SOC 2 Type II compliance.
No. No security program removes all risk. SOC 2 shows that strong controls are in place and working, which is why it is a useful part of vendor evaluation.
