Notion
A twelve-month observation window across four TSCs.
Full-year SOC 2 Type II for a collaboration platform serving enterprise customers, including workspace-level tenancy isolation testing.
- Sector
- Productivity SaaS
- Framework
- SOC 2 Type II · Security, Availability, Confidentiality
- Year
- 2025
- Signed by
- Partner
§ 01 — Scope
What we tested.
- 01Access provisioning and deprovisioning sampling (n=180)
- 02Change management and CI/CD pipeline evidence
- 03Incident response tabletop review
- 04Sub-processor governance
§ 02 — Findings
01
One low-severity exception on quarterly access review timing, remediated in observation.
02
Zero exceptions on encryption, logging, and BCP controls.
§ 03 — Outcome
Unqualified opinion issued. Report accepted by the client's three largest enterprise customers without follow-up.
§ 04 — Next