Descript is Now SOC 2 Type I Compliant

Since Descript was founded, we’ve treated the security, confidentiality, and privacy of our users’ data with the utmost care. We know that the data our users share with us ranges from the personal to the proprietary, and we take our responsibility to protect that data very seriously.  

Today, we’re proud to announce that we are SOC 2 Type I compliant, and we expect to be SOC 2 Type II compliant in 2021. That means that the integrity of the systems we have in place to protect our users’ data has been verified by an independent auditor, and we will continue to conduct these audits regularly.

“Descript’s systems and security are trusted by companies such as The New York Times, HubSpot, NPR, and Al Jazeera,” says Jay LeBoeuf, Descript’s Head of Business Development. “Our SOC 2 certification and Single Sign-On (SSO) support now allows Enterprise clients to rapidly integrate Descript into their existing teams and workflows.”

What is SOC 2 compliance, and why does it matter?

SOC stands for Systems and Organizations Controls, and it refers to a series of reports produced and administered by the American Institute of Certified Public Accountants (AICPA) during an audit of an organization like Descript. SOC 2 specifically covers controls relevant to security, availability, processing integrity, confidentiality, and privacy. Together, these overlapping concerns ensure your data is adequately protected within the organizations you share it with.

“The privacy, confidentiality, and security of our users’ data has been a top priority for us since day one, and a lot of the work that we’ve done over the past year to achieve SOC 2 compliance has been formalizing internal policies and automating security controls to help us scale this culture as we grow the company,” says Sunny Rochiramani, Vice President of Engineering at Descript.

SOC 2 Type I confirms compliance at a specific point in time: In Descript’s case, December 15, 2020. SOC 2 Type II confirms continued compliance six months after Type I, and we expect to certify this compliance later in 2021.

What steps were involved in achieving SOC 2 compliance?

Because of the work we had already done to protect our users’ privacy and the security of their data, attaining SOC 2 Type I compliance was primarily about codifying policies already in place and automating security reviews.

Some of the work we did to earn SOC 2 Type I compliance was:

  • Ensuring secure credentials for Descript team members, including generating cryptographically secure passwords for all team members with a company-wide password manager, encrypting team members’ hard drives, and requiring two-factor authorization for any team member with access to critical infrastructure services
  • Partnering with Vanta to provide continuous monitoring of SOC 2 required controls, cutting down our overhead incurred to ensure we stay compliant over time
  • Reviewing and codifying our policies to protect user data, which includes requiring users’ explicit permission to allow Descript team members to access their data for the purpose of customer service, and logging requests to access user data on our servers for future audits
  • Enforcing infrastructure security, including third-party security reviews on application code and automating our monitoring and alert systems

Where can I read more about the systems and policies in place to protect user data?

For detailed information, visit our Security and Confidentiality page, which contains an overview of Descript’s data security and confidentiality systems. In a nutshell: Your Project data — the files you upload to Descript, the transcripts of those files, and other associated metadata — are confidential, even from Descript, and if you delete your data, we permanently delete it from our servers.

Our Privacy Policy explains in full how we collect information from our users, how we use that information, and how we disclose that information. Our Terms of Service governs use of and access to Descript’s audio editing and transcription tools.

Where can I obtain a copy of Descript’s SOC 2 report?

Our SOC 2 report is only available to our Enterprise clients. Please visit our Pricing page to discover the features of Descript Enterprise accounts, and contact us to learn more about becoming an Enterprise client.

Featured articles:

No items found.

Articles you might find interesting

Video

5 questions to ask when choosing video background music

Want to turn a vlog into a cinematic experience, or make a how-to video feel upbeat and engaging? The right soundtrack can help you with all of that.

Podcasting

How to choose a mic for your podcast

Finding the right mic comes down to understanding your specific needs and knowing your options. Here are a few considerations to keep in mind for the right microphone.

Product Updates

Video Marketing Pro Amanda Horvath on Leveraging the Power of Video To Boost Your Business

Amanda Horvath is a video marketer who helps entrepreneurs and creators leverage the power of video through her YouTube channel and in-depth video courses. We recently sat down with Horvath to get her thoughts on what video content can do for businesses, what different types of videos accomplish, and how to get started making your own videos with minimal fuss.

Video

Jump cut: A beginner’s guide

Discover the art of the jump cut transition in video editing. Learn how to use jump cuts to enhance your video’s pacing, style, and storytelling.

Product Updates

Here's what creators are saying about Descript Season 1: Overdub, Studio Sound + more

We asked creators to test out the latest features from Descript's Season 1 update, including our voice cloning Overdub software, Studio Sound audio enhancement tool and more.

Related articles:

Share this article

Get started for free →