SOC 2 Once Proves Our Controls. Twice Proves They Hold.

Last year, we announced Quiltt's first SOC 2 Type 2 certification. At the time, we called it a milestone. And it was. But one year of clean controls tells only part of the story.

This year, we're announcing our second consecutive SOC 2 Type 2 audit, covering Security, Availability, Processing Integrity, and Confidentiality. And the story it tells is different.

What changes in year two

A first-year SOC 2 Type 2 demonstrates that our controls were designed correctly and functioning during the audit period. That matters. But it leaves an open question: were those controls built to pass a review, or built to last?

A second consecutive report answers that question. It means the same controls held up through another full year of product development, team growth, and operational change. Not because an audit was coming, but because that's how Quiltt runs.

When you’re evaluating Quiltt as part of your infrastructure, that distinction is meaningful. Bank partners, sponsor banks, and enterprise compliance teams don't just perform vendor reviews one time. Those security questionnaires recur. Vendor re-certification is annual. You can be confident that Quiltt takes security and data controls seriously, year after year.

What this means for builders on Quiltt

When you build with Quiltt, you inherit a compliance foundation that has been independently verified two years running. That has direct, practical consequences for your team:

• Bank partner and sponsor bank vendor reviews become substantially lighter. The controls you’re asked about are documented, tested, and auditor-verified: encryption, access management, incident response, availability, data integrity.
• Your customers and their customers benefit from infrastructure that meets the standards financial institutions expect from every layer of the stack.
• Your compliance and engineering teams spend less time explaining how your infrastructure works and more time building on top of it.

Most companies pursue SOC 2 because a deal or a partner requires it. We've treated it as foundational infrastructure. Quiltt maintains these controls continuously, not just when the next review arrives.

Built for where you're going, not just where you are

Open banking infrastructure sits at the center of some of the most sensitive data flows. Our customers use Quiltt to move money, power underwriting decisions, and transform financial services. That context demands a partner whose compliance posture keeps pace with their growth.

Two consecutive SOC 2 Type 2 audits don't make compliance frictionless (If you've figured out how to make compliance frictionless, there's probably a venture fund waiting to invest in you.) But they do mean that when your next bank partnership review arrives, you're walking in with a track record—not a stack of excuses.

That's the goal. We help you keep moving from launch to scale and beyond.

Our sincere appreciation goes to Insight Assurance for their diligent evaluation and validation of our compliance efforts, ensuring that we uphold the highest standards of security and accountability.

‍