Descript is Now SOC 2 Type I Compliant

Since Descript was founded, we’ve treated the security, confidentiality, and privacy of our users’ data with the utmost care. We know that the data our users share with us ranges from the personal to the proprietary, and we take our responsibility to protect that data very seriously.  

Today, we’re proud to announce that we are SOC 2 Type I compliant, and we expect to be SOC 2 Type II compliant in 2021. That means that the integrity of the systems we have in place to protect our users’ data has been verified by an independent auditor, and we will continue to conduct these audits regularly.

“Descript’s systems and security are trusted by companies such as The New York Times, HubSpot, NPR, and Al Jazeera,” says Jay LeBoeuf, Descript’s Head of Business Development. “Our SOC 2 certification and Single Sign-On (SSO) support now allows Enterprise clients to rapidly integrate Descript into their existing teams and workflows.”

What is SOC 2 compliance, and why does it matter?

SOC stands for Systems and Organizations Controls, and it refers to a series of reports produced and administered by the American Institute of Certified Public Accountants (AICPA) during an audit of an organization like Descript. SOC 2 specifically covers controls relevant to security, availability, processing integrity, confidentiality, and privacy. Together, these overlapping concerns ensure your data is adequately protected within the organizations you share it with.

“The privacy, confidentiality, and security of our users’ data has been a top priority for us since day one, and a lot of the work that we’ve done over the past year to achieve SOC 2 compliance has been formalizing internal policies and automating security controls to help us scale this culture as we grow the company,” says Sunny Rochiramani, Vice President of Engineering at Descript.

SOC 2 Type I confirms compliance at a specific point in time: In Descript’s case, December 15, 2020. SOC 2 Type II confirms continued compliance six months after Type I, and we expect to certify this compliance later in 2021.

What steps were involved in achieving SOC 2 compliance?

Because of the work we had already done to protect our users’ privacy and the security of their data, attaining SOC 2 Type I compliance was primarily about codifying policies already in place and automating security reviews.

Some of the work we did to earn SOC 2 Type I compliance was:

  • Ensuring secure credentials for Descript team members, including generating cryptographically secure passwords for all team members with a company-wide password manager, encrypting team members’ hard drives, and requiring two-factor authorization for any team member with access to critical infrastructure services
  • Partnering with Vanta to provide continuous monitoring of SOC 2 required controls, cutting down our overhead incurred to ensure we stay compliant over time
  • Reviewing and codifying our policies to protect user data, which includes requiring users’ explicit permission to allow Descript team members to access their data for the purpose of customer service, and logging requests to access user data on our servers for future audits
  • Enforcing infrastructure security, including third-party security reviews on application code and automating our monitoring and alert systems

Where can I read more about the systems and policies in place to protect user data?

For detailed information, visit our Security and Confidentiality page, which contains an overview of Descript’s data security and confidentiality systems. In a nutshell: Your Project data — the files you upload to Descript, the transcripts of those files, and other associated metadata — are confidential, even from Descript, and if you delete your data, we permanently delete it from our servers.

Our Privacy Policy explains in full how we collect information from our users, how we use that information, and how we disclose that information. Our Terms of Service governs use of and access to Descript’s audio editing and transcription tools.

Where can I obtain a copy of Descript’s SOC 2 report?

Our SOC 2 report is only available to our Enterprise clients. Please visit our Pricing page to discover the features of Descript Enterprise accounts, and contact us to learn more about becoming an Enterprise client.

Featured articles:

No items found.

Articles you might find interesting

Video

How do teleprompters work, and do I need one?

A teleprompter might sound like a dream come true — why wouldn’t you want to read something while still making eye contact with your audience? But just like with anything, there are tradeoffs to using a teleprompter.

Podcasting

The complete history of podcasts

From the RSS feed to the iPod to the success of Serial, dive into the fascinating history of podcasts and how they became such a global phenomenon.

Other stuff

How To Mix Music: Make Your Recordings Sound Like A Hit Song

After reading this article, you’ll probably want to dive right into mixing your own music. Here is a one step-by-step approach and some tips to follow as you learn how to mix a song or audio.

Podcasting

The podcast advertising rates guide for 2023

In this guide, we’ll cover different advertising types you can have on your podcast and the range of rates you can charge your sponsors.

Podcasting

10 best podcast editing software options in 2023

Explore the 10 best podcast editing software options to elevate your podcast production. Learn why Descript stands out with its all-in-one editing capabilities.

Podcasting

The 15 most popular podcasts right now

Explore the most popular podcasts of the moment. Discover trending topics and captivating hosts to find your next favorite podcast.

Related articles:

Share this article

Get started for free →