Revopush partners with Vanta on the path to SOC 2 Type II
We have partnered with Vanta to begin working toward a SOC 2 Type II report. This is an important step in building a more structured, transparent, and verifiable security program around the way we develop and operate Revopush.
Security already shapes how we build Revopush. As an over-the-air update platform, we understand that customers depend on us to protect access to their applications, deployments, releases, and operational data. Our work with Vanta will help us strengthen that foundation and make our practices easier to examine and trust.
This announcement marks the beginning of the process. Revopush has not yet completed a SOC 2 Type II audit or received a SOC 2 Type II report. The work ahead will include formalizing controls, operating them over an observation period, collecting evidence, and engaging an independent auditor to evaluate their effectiveness.
What SOC 2 Type II will mean for Revopush
SOC 2 is a widely recognized framework for documenting and assessing controls related to the security, availability, confidentiality, processing integrity, and privacy of customer data. A Type II examination goes beyond checking whether controls are designed appropriately at a single point in time. It evaluates whether those controls operate effectively over a defined period.
That distinction matters to us. Our goal will not be to prepare for a one-time review and return to business as usual. We will use the process to make security and reliability more consistent parts of our everyday engineering and operational work.
Working toward SOC 2 Type II will give us a clear framework for reviewing how we manage access, develop and release software, monitor infrastructure, respond to incidents, assess vulnerabilities, and work with third-party providers. It will also help us document ownership and evidence so that important controls are repeatable rather than dependent on individual knowledge.
How Vanta will support the process
Vanta's SOC 2 platform is designed to bring compliance work, evidence collection, and continuous control monitoring into one place. We will use it to map our systems and processes to relevant controls, identify gaps, assign remediation work, and monitor whether controls continue to operate as expected.
This should make the work more useful to the engineering team. Instead of treating compliance as a separate collection of documents created only for an audit, we will connect it to the systems and workflows we use to build and operate Revopush.
Vanta will support our preparation and ongoing monitoring, but it will not issue the SOC 2 Type II report. That assessment will be performed by an independent audit firm after the required controls have been in operation for the agreed observation period.
Improving how we build and operate Revopush
The value of this work will extend beyond the final report. We expect it to improve several parts of our development and operations:
- Software delivery: clearer change-management practices, documented reviews, and stronger evidence around how changes reach production.
- Access management: more consistent access reviews, defined ownership, and removal of access when it is no longer needed.
- Vulnerability management: better visibility into findings, remediation priorities, and the evidence that issues have been addressed.
- Incident response: documented responsibilities and a repeatable process for investigation, containment, recovery, and follow-up.
- Infrastructure and vendor oversight: clearer inventories, risk reviews, and accountability for the services involved in operating Revopush.
These improvements will help us reduce ambiguity inside the company. Teams will have clearer expectations, customers will have a more transparent view of how we manage risk, and important security practices will be supported by ongoing evidence.
What this will mean for customers
Customers should be able to evaluate a technology provider using more than promises. By working toward SOC 2 Type II, we aim to give current and prospective customers clearer visibility into how Revopush defines and follows its security and operational controls. An independent auditor will then assess whether those controls operated effectively during the observation period.
The process will also make conversations with security, procurement, and engineering teams more straightforward. Our goal is to provide clearer answers about how we protect systems and data, who is responsible for key controls, and how we verify that those controls continue to work.
This will be especially important for larger organizations that require formal assurance before adopting a service involved in their software delivery process.
The path ahead
Our next steps will be to complete the readiness work, close identified gaps, operate the controls through the observation period, and prepare for the independent audit. We will share further updates as we reach meaningful milestones.
In the meantime, our current infrastructure, data-protection practices, development controls, and incident-response approach are described in the Revopush security statement.
Partnering with Vanta is a commitment to improving how we build Revopush, not just how we describe it. We want the SOC 2 Type II process to help us create a company that is more disciplined internally and more transparent and dependable for every customer.
For questions about security or our SOC 2 Type II journey, contact [email protected].
