Defense in depth Audited by design

SOC stands for System and Organization Controls, a suite of services provided as part of the reporting platform of the American Institute of CPAs (AICPA). A SOC 2 audit examines and evaluates the operational controls of a business. The audit requires a company to document and follow comprehensive information security policies and procedures. The resulting report gives interested parties (prospects, customers, auditors) additional information and insight to make a decision about working with that business.

SOC 1 audits focus on internal controls over financial reporting, testing the design and operating effectiveness of controls that are relevant to user entities' financial statements. OAN views SOC 1 audits and other periodic third-party reviews as a valuable resource to enhance both the OAN platform and OAN Pay, our payments system.

A Type 1 report tests controls at a single point in time, essentially answering the question "were the controls in place on this date?" A Type 2 report tests controls over an extended period, typically 6 to 12 months, answering the harder question "were the controls working consistently throughout this period?" Type 2 is the more demanding and comprehensive standard. OAN has always voluntarily pursued Type 2 for both SOC 1 and SOC 2, with a 12-month audit period, because it gives customers the strongest possible assurance.

OAN is SOC 1 and SOC 2 Type 2 certified: it has successfully completed SOC 2 Type 2 and SOC 1 Type 2 audits. Our auditors determined that our controls were effectively designed and followed throughout the 12-month audit period. Relevant portions of both reports are available upon request under NDA during procurement. Your security, compliance, and vendor risk teams can review the full audit report, controls testing, and auditor opinion before signing anything.

Data at rest is encrypted with Oracle Transparent Data Encryption (TDE) at AES-256. Keys are managed by OCI Vault with customer-managed keys (CMEK) by default, and bring your own key (BYOK) supported for customers who require it. Data in motion is protected by TLS 1.3 end to end, with certificates rotated automatically. Nothing about OAN requires you to hand over your keys.

Critical CVEs in Oracle, OCI, or any OAN dependency are patched on a contracted SLA. Criticals typically get same-day or next-business-day turnaround; highs and mediums are scheduled per the SLA in your contract. Your security team is notified through documented channels the moment remediation begins, and the audit log captures every step of the patch cycle.

OAN runs 24x7 security monitoring with documented incident response playbooks. If an incident occurs, your security team is notified per the SLA in your contract with full forensic detail from the unified audit log. Post-incident reports are delivered on your timeline, and runbooks are available for your review during procurement. Every agent action, every human action, and every platform event lands in the same audit log.

LSEG Risk Intelligence powers sanctions, PEP, adverse media, and identity screening inside the Global Risk Agent product. SOVOS handles sales tax, VAT, and indirect tax compliance inside AP and PO workflows. DocuSign and Adobe Acrobat Sign are the digital signature options for contract execution and invoice sign-off. New partners are added as customers need them, without changing the underlying platform.

HIPAA: technical safeguards, access controls, audit trails, and BAA available for healthcare customers. GDPR: data subject rights, right to erasure, data residency controls, and processing records. SOX: segregation of duties, change management, and immutable audit trails that support your control narrative. None of these are separate products. They come with the platform.

SOC 2 Type 2 and SOC 1 Type 2 reports are issued annually with a 12-month audit period. Internal controls, access reviews, and change management are continuously monitored and sampled throughout the year. Penetration testing is performed annually by an independent firm, and remediation is tracked and verified. Using an independent third party to audit these controls is an investment we are proud to undertake because it gives customers the strongest possible assurance about our operational, data security, and privacy practices.