Raxis Achieves SOC 2 Type 2 Compliance
We are thrilled to announce that Raxis has successfully achieved SOC 2 Type 2 compliance, providing assurance to our clients that their data is handled securely
SOC 2 Penetration Testing
You’ll know it wasn’t AI generated. So will your auditor. Testing that strengthens your security posture, not just your audit binder.
Scoped to Your System Description
The system your report describes is the system we test: the SaaS application, its APIs, and the cloud accounts it runs in. Nothing your auditor will call out of scope.
Inside Your Observation Window
For a Type II report, we schedule the test and the retest inside the period your auditor examines, so both count as evidence.
Mapped to the Criteria
Findings cite the Trust Services Criteria they bear on, so your auditor can trace each one to a control without asking you to translate.
| Criterion | What we test | Evidence for your auditor |
|---|---|---|
| CC4.1 Ongoing and separate evaluations | Your controls, by an independent party, on a defined scope | A dated report with methodology, scope, and tester credentials |
| CC6.1 Logical access security | Authentication, authorization between tenants, role and privilege boundaries | Every path from one user’s data to another’s, or from user to admin |
| CC6.6 Protection against threats from outside the boundary | Internet-facing services, APIs, and cloud edge configuration | What an outsider can reach, and what they can do with it |
| CC6.7 Transmission of information | TLS configuration, cleartext interfaces, exposed storage | Where customer data moves or rests unprotected |
| CC6.8 Unauthorized or malicious software | Whether your endpoint and build pipeline controls stop our payloads | What ran and what was blocked |
| CC7.1 Detection of vulnerabilities and configuration changes | Exploitability of what your scanners report, plus what they miss | Findings ranked by real exploitability, not scanner severity |
| CC7.2 Monitoring for anomalies | Whether your monitoring noticed our activity during the test | What alerted, what didn’t, and how long it took |
Tested Outside the Window
A Type II report covers a period. A test that finished the month before it started is evidence for nothing your auditor is examining.
The Wrong System
The pentest covered the corporate network. The report describes the SaaS platform. The auditor will ask where the platform’s test is.
Findings With No Follow-Through
Critical findings left open with no remediation evidence invite an exception. We retest inside the window and document each fix.
A Scan Sold as a Pentest
CC4.1 is about evaluating whether controls work. An automated scan with a cover letter evaluates nothing an auditor can rely on.
Before a Type I
Test a few weeks ahead so you can fix what we find. Your auditor sees a designed control and the evidence it was checked.
Early in a Type II Window
Test in the first third of the period. Fixes and the retest then land inside the window too, which is the evidence that controls operated.
Every Year After
Each annual report needs its own evidence. A test from the previous period doesn’t carry over.
Continuously, If You Ship Weekly
Raxis Attack tests all year with findings live in Raxis One, so every release inside the window has been tested.
From Our Engineers: SOC 2 in Practice
Written by the Raxis engineers who run these tests, from real engagements and research.
SOC 2 Compliance: Is it Right for Your Organization?
SOC 2 is a compliance and privacy standard that outlines how to manage customer data & related systems to ensure confidentiality, integrity, and availability.
Why We Don’t Change Risk Ratings on Pentest Findings (Even When You Ask Nicely)
Raxis’ Tim Semchenko explains why we can’t lower risk ratings for your penetration test findings just because you ask and why that’s a good thing.
FAQ: SOC 2 Penetration Testing
Is penetration testing required for SOC 2?
Not as a named requirement. SOC 2 doesn't prescribe control activities. The points of focus for CC4.1 list penetration testing among the evaluations an entity can use, and most auditors expect one for the Security category, especially for a SaaS platform.
When should the pentest happen for a Type II report?
Inside the observation period, and early enough that remediation and the retest fall inside it too. A test completed before the period starts doesn't evidence controls operating during it.
What should be in scope?
The system your SOC 2 report describes. For most SaaS companies, that means the production application, its APIs, tenant isolation, and the cloud accounts it runs in. If the report covers more, such as a support platform, the test should too.
What happens if the pentest finds critical issues during our audit period?
Finding issues is expected. What matters to your auditor is that you responded: a fix, a retest, and a record of both. Open criticals with no plan are what lead to exceptions.
Can we share the pentest report with customers?
Most customers ask for a summary rather than the full technical report. Every Raxis engagement includes an attestation letter written for that purpose, alongside the full report for your team and auditor.
Is Raxis SOC 2 compliant itself?
Yes. Raxis completes a SOC 2 Type 2 examination every year. Our most recent report covers April 12, 2025 through April 11, 2026 and is available under NDA. The controls are summarized in our Trust Center.