> ## Documentation Index
> Fetch the complete documentation index at: https://support.amplify.xyz/llms.txt
> Use this file to discover all available pages before exploring further.

# SOC 2 Compliance

> How Amplify protects customer data through SOC 2 Type II–certified security controls.

> Amplify is SOC 2 Type II compliant

Amplify’s **SOC 2 Type II compliance** demonstrates our commitment to protecting customer data through strong security, operational controls, and ongoing risk management.\
An independent third-party auditor has verified that our controls are **designed appropriately and operate effectively over time**, not just at a single point.

This helps customers trust Amplify with sensitive communications across fax, e-sign, forms, and Connect (call, meet, and messaging).

***

## What is SOC 2?

**SOC 2 (System and Organization Controls 2)** is a security and privacy framework developed by the **American Institute of Certified Public Accountants (AICPA)**. It defines how organizations should manage customer data responsibly.

SOC 2 is based on five **Trust Services Criteria**:

* **Security** – Protection against unauthorized access
* **Availability** – System uptime and reliability
* **Processing Integrity** – Accurate and complete processing
* **Confidentiality** – Protection of sensitive information
* **Privacy** – Responsible handling of personal data

A **Type II report** evaluates these controls **over an extended audit period**, confirming that safeguards are consistently followed in real-world operations.

***

## What Amplify’s SOC 2 compliance covers

Amplify’s SOC 2 Type II report validates controls across our platform, including:

* User access management and role-based permissions
* Secure data handling across fax, e-sign, forms, and Connect
* Encryption of data in transit and at rest
* Monitoring, logging, and incident response procedures
* Internal policies, employee training, and vendor risk reviews

These controls help ensure customer data remains protected throughout its lifecycle—from document upload to delivery, signing, storage, and audit logging.

<Note>
  SOC 2 focuses on Amplify’s internal controls. Customers are not required to configure anything to benefit from our SOC 2 compliance.
</Note>

***

## Security Beyond Certification

SOC 2 compliance is not a one-time milestone. At Amplify, we maintain a **continuous security and compliance program** to ensure our controls remain effective and up to date.

Our ongoing practices include:

* Regular access and permission reviews
* Continuous monitoring of security systems
* Periodic updates to policies and controls
* Mandatory employee security awareness training

This proactive approach allows us to identify potential risks early and maintain a strong security posture as our platform evolves.

***

## Requesting Amplify’s SOC 2 report

Due to the sensitive nature of SOC 2 reports, access is restricted and shared only under appropriate confidentiality agreements.

To request a copy of Amplify’s SOC 2 Type II report:

* Reach out to your **customer success representative**, or
* Submit a request via our **Support team**

<Tip>
  If your organization requires vendor security questionnaires, compliance attestations, or related documentation, please mention this when submitting your request so we can process everything together.
</Tip>

***

## Do customers need to take action?

No.\
SOC 2 compliance reflects **Amplify’s internal security controls** and does not require customers to enable, configure, or manage any additional settings.

You can continue using Amplify normally while benefiting from our certified security practices.

## FAQs

<AccordionGroup>
  <Accordion title="What does SOC 2 Type II mean for Amplify customers?">
    SOC 2 Type II confirms that Amplify’s security controls are not only designed correctly but also operate effectively over time, helping protect customer data across fax, e-sign, forms, and Connect.
  </Accordion>

  <Accordion title="Does SOC 2 require any setup from my side?">
    No. SOC 2 reflects Amplify’s internal security practices and does not require customers to configure or enable anything in their account.
  </Accordion>

  <Accordion title="Is Amplify’s SOC 2 report publicly available?">
    No. SOC 2 reports contain sensitive security information and are shared only upon request under appropriate confidentiality terms.
  </Accordion>

  <Accordion title="Does SOC 2 replace HIPAA compliance?">
    No. SOC 2 and HIPAA address different requirements. SOC 2 focuses on security controls, while HIPAA governs the protection of healthcare information and regulatory compliance.
  </Accordion>
</AccordionGroup>