Snapshot 66823
Normalized text
Scripts and page chrome removed; this is what change detection compares.
Close Search Security & Trust at Smart Merchandiser Completed SOC 2® Type II and SOC 3 examinations · Period April 9 – July 9, 2026 · Johanson LLP Independent reports on the operating effectiveness of our controls relevant to Security. Building on our SOC 2 Type I (April 2026). SOC 3 report available now as a free download. Full SOC 2 Type II report available to qualified parties under NDA. Smart Merchandiser is built on a single architectural choice that shapes every other decision we make: our AI runs on catalog and performance data only — never on customer PII. Below is what that means in practice, and how we prove it. Current attestation Examination types SOC 2® Type II (description of the system plus the suitability of design and operating effectiveness of controls over a period) and SOC 3® (general-use summary report) Examination period April 9, 2026 – July 9, 2026 Report issued July 28, 2026 Service auditor Johanson LLP — Colorado Springs, Colorado Scope Smart Merchandiser system (SM4, SaaS, AWS-hosted) Trust Services Criteria Security Service auditor’s opinion Unqualified — controls were suitably designed and operated effectively throughout the period (see Section I of each report) SOC 3 availability General-use report — free download below SOC 2 Type II availability Restricted-use — available under NDA Standards AICPA AT-C 105 / 205; TSP 100 (2017, Revised Points of Focus 2022); DC 200 (2018, Revised Implementation Guidance 2022) What’s in scope The audit covers Smart Merchandiser Version 4 (SM4ALL), the SaaS platform our customers use today. The system is browser-based and hosted on Amazon Web Services. The legacy IBM Cloud version is in the final stages of decommissioning. Principal service commitments The following commitments are made to our customers through Master Service Agreements and Service Level Agreements, and are reflected in the audited system description. Security Protection of system resources and customer data through administrative, logical, and technical controls: Role-based access control (RBAC) Multi-factor authentication (MFA) for all production access Encryption of data in transit and at rest Enforcement of least privilege access Continuous security monitoring Availability 99.95% contractual uptime commitment Multi-availability-zone (Multi-AZ) deployment Serverless architecture for elastic scaling Content delivery optimization via Amazon CloudFront AWS CloudWatch monitoring with alerting on anomalies Confidentiality Encryption mechanisms applied throughout Restricted access controls (least privilege + RBAC) Zero-copy architecture — customer catalog data is read on demand from the source ecommerce platform, processed transiently, and returned without persistence Secure data handling procedures Processing Integrity Real-time API-based data retrieval from source systems Minimal transformation — limited to merchandising-position logic (product-ordering values for display) Automated and rules-based processing controls Monitoring and validation procedures Privacy Privacy is explicitly out of scope for the SOC 2 examination because the system does not process personal data beyond minimal user-authentication metadata. This is by design: our AI does not need customer PII to deliver merchandising outcomes. Subservice organizations and shared responsibility We rely on a small set of subservice organizations for cloud infrastructure and platform services. The audited system description identifies these dependencies and notes that complementary subservice-organization controls — and complementary user-entity controls — are necessary alongside our own controls to achieve our service commitments. This shared-responsibility model is standard for SaaS audits. Primary subservice organizations: Amazon Web Services (production hosting, us-east-1) Auth0 / Okta (Smart Merchandiser customer authentication only — not staff identity) Upstash Redis (cache layer) Atlassian Cloud / Bitbucket (internal collaboration and source control) Google Workspace (Zobrist staff productivity — not customer data) Vulnerability and patch management We maintain a continuous vulnerability scanning and remediation program with tiered SLAs: Critical findings: remediated within 7 days (most recent program data: 424 prior Critical findings remediated within 3 days) High severity findings: remediated within 30 days As of the Type 1 as-of date: 0 open Critical findings; High severity findings under active remediation against the 30-day SLA The Vulnerability & Patch Management Policy is reviewed annually and was most recently re-issued (v1.2) in May 2026. Backups and continuity DynamoDB Point-in-Time Recovery (35-day window) provides continuous incremental backup Per-environment weekly snapshots to dedicated S3 backup buckets in us-east-1 Business Continuity and Disaster Recovery plans documented and approved (T-5.2 evidence; approved February 2026) Cross-region replication is not currently implemented; the residual region-level outage risk is formally accepted per documented risk acceptance (CEO approval March 2026, evidence T-94.1) Compliance roadmap Milestone Status SOC 2 Type 1 (Security) Complete April 9, 2026 SOC 2 Type II (Security) Complete Period Apr 9 – Jul 9, 2026; issued Jul 28, 2026 SOC 3 (Security) Complete Issued Jul 28, 2026; public download Policy library refresh (2026 cycle) Complete May 2026 Continuous monitoring toward next annual Type II period In progress Access the reports SOC 3 report (public) A general-use summary you can share freely with your security and procurement teams. No NDA required. Download the SOC 3 report (PDF) SOC 2 Type II report (under NDA) The full report is restricted to Zobrist, our user entities and business partners, their practitioners, and regulators with sufficient knowledge of the system (per Section I of the report). To request the SOC 2 Type II report, contact us. We will send a mutual non-disclosure agreement for execution; once executed, we send the report along with a brief orientation letter. For technical questions or to schedule a walkthrough with our CTO or CIO, the same address routes appropriately.