Rippling achieves “gold standard” SOC 2 type II security certification

After all, Rippling is an always-up-to-date source of truth for all your employee data, and many of the internal controls SOC 2 requires involve HR and IT. So we used this opportunity to be the guinea pig and test how useful Rippling actually is for this use case.

How Rippling simplifies SOC 2 compliance 

We were thrilled to find that Rippling takes a lot of the pain out of the SOC 2 process by automating data collection and policy compliance in many instances. Having a unified employee system of record made it much easier to demonstrate compliance with security controls.

For example, companies may want to show that when an employee is terminated, all of their access to company systems is also terminated immediately. This is an important security safeguard, yet one study found 89% of former employees retain access to at least one of their former employer’s systems after they leave.

Fortunately, Rippling not only tracks dates of employment as well as what tools workers had access to - it automatically disables employee access to all software when they’re terminated and allows admins to remotely wipe their laptops. Our Custom Reports tool makes it easy to document that this protocol was followed in just a few clicks.

Here are some of the ways we used Rippling during SOC 2:

HR

• Automated employee account creation and deletion in our onboarding and offboarding procedures

• Automated background checks as part of the hiring flow

• Automated evidence collection for new hire population, terminated employee population, account creation/deletion dates, and more

Security and provisioning

• Enforced a strong password policy and 2FA settings within Rippling

• Used Rippling SSO/SAML to securely access all critical third-party applications and infrastructure

Hardware

• Provided an up-to-date inventory of all employee laptops, including information on hardware, OS, antivirus software, and status of security patches

The SOC 2 process was a great learning experience for us. Now that we know what our product can do, we’re eager to support customers going through their own security certification audits.