Snapshot 257671
Raw (normalized text)
Scripts and page chrome removed; this is what change detection compares.
Skip to navigationSkip to main content Soraban Security built for tax and financial data, backed by SOC 2 and strong, practical controls. Get clear visibility into how we protect your data, manage risk, stay compliant with IRS and other regulatory requirements, and maintain reliability across our platform. security@soraban.com Privacy PolicyOpens in new tab Use this Trust Center to evaluate Soraban's security program in depth. Download our SOC 2 report and supporting security documentation, review the policies and controls that protect your data, see real-time status of our monitored controls, and request anything not published here. We aim to make security diligence on Soraban as fast and transparent as possible. Compliance SOC 2 NIST 800-63 IRS Publication 1345 Resources View all SOC 2 Report SOC 2 Bridge Letter for 2026 SOC 2 Auditor Memo Penetration Test Report Security, Compliance and Responsible AI Overview Controls View all Infrastructure security Unique account authentication enforced Production database access restricted Production network access restricted View 3 more Infrastructure security controls Organizational security Anti-malware technology utilized Performance evaluations conducted Password policy enforced View 1 more Organizational security control Product security Data encryption utilized Control self-assessments conducted Internal security procedures Continuity and Disaster Recovery plans established Board charter documented Organization structure documented Subprocessors View all Amazon Web Services • Infrastructure & Cloud Hosting Provides secure cloud infrastructure used to host Soraban’s application, databases, and file storage. Customer data is stored and processed within AWS environments. Cloudflare • Network Security, DNS & Content Delivery Provides DNS hosting, content delivery network (CDN) services, and web application security protections (including DDoS mitigation and firewalls) to secure and accelerate access to Soraban systems. WorkOS • Authentication & Identity Management Supports secure user authentication for all users accessing Soraban. Vercel • Cloud Hosting Hosts and delivers portions of Soraban’s web application interface, ensuring fast and reliable access to user-facing components. FAQ View all Updates View all General Critical Vulnerability with PHP Published October 23, 2026 On October 21, 2026, the PHP project released fixes for two critical vulnerabilities in the PHP interpreter, known collectively as PHP2Shell. These flaws can allow unauthenticated remote code execution on servers running unpatched PHP. Soraban is not affected, and no action is required for your use of Soraban. Soraban’s systems Soraban’s application and infrastructure do not use PHP, so these vulnerabilities do not affect the Soraban platform or customer data. Our security team began assessing exposure as soon as the vulnerabilities were disclosed, and we are continuing to monitor for related activity. Our subprocessors Under our vendor risk management program, we assess each subprocessor’s security posture, including independent audit reports such as SOC 2 Type II where available, and their controls for identifying and remediating critical vulnerabilities promptly. For this issue we are reviewing all subprocessors, starting with those most critical to the delivery of our service: Amazon Web Services (infrastructure and hosting) Cloudflare (network edge and security) Google (identity and productivity) Mailgun (transactional email) Stripe (payment processing) Responses from vendors vary. Some, including Cloudflare and Google Cloud, have published guidance or statements about these vulnerabilities. As of this update, we have not identified a public statement from others, including Stripe. The absence of a statement does not by itself indicate that a vendor is affected. Many providers comment only when their services are impacted. Where no statement is available, we rely on our existing assessment of the vendor’s security program. Roadmap Expanding Multi-Factor Authentication Options Published April 24, 2026 We’re expanding multi-factor authentication (MFA) options to provide stronger security and more flexibility. In addition to SMS-based MFA, we’re introducing support for app-based authenticators (QR code setup) and passkeys. MFA is required for all firm users, and firms can choose to require MFA for all clients. These new options allow users to select the method that best fits their security preferences and workflows.