Zamp has completed its SOC 2 Type II examination, with zero exceptions.
That last part is the headline for us. Over a four-month observation period, an independent auditor tested how we protect customer data, and every control test came back with no exceptions noted.
The report doesn’t mark the day Zamp became secure. Protecting our customers’ financial data is part of how we build and operate every day. What’s new is the independent, formal proof behind it.
What SOC 2 Type II actually measures
SOC 2 is the security framework developed by the AICPA, the same body that sets standards for the accounting profession. A Type I report checks that controls are designed well at a single point in time. A Type II report goes further: it tests whether those controls actually work, day after day, over an extended observation period.
Our auditor, Prescient Assurance, tested Zamp’s controls against the AICPA’s Security criteria over a four-month observation period, April 20 to August 30, 2026. Security is the foundation of every SOC 2 report. It covers how we control access, encrypt data, manage changes to our software, monitor for threats, respond to incidents, and vet the vendors we rely on.
“Zero exceptions” means the auditor found no instances where a control failed to operate as designed during the observation window. Combined with an unqualified opinion, it’s the strongest outcome a SOC 2 Type II report can deliver.
Built in from the start, not bolted on
A Type II audit can only test what's already running. The controls our auditor examined are the same safeguards that protect customer data every day, including:
- Role-based access controls that limit who can see and touch customer data
- Encryption of sensitive customer data at rest (AES-256) and in transit (TLS 1.3)
- Multi-factor authentication required for administrative and production access
- Ongoing monitoring and review of how those controls perform
- Annual independent penetration testing with no critical or high-severity findings in our most recent test
- Peer review and approval of every code change before it reaches production
Sales tax data is financial data. It carries transaction history, customer records, and filing details across every state where a business sells. Our team of sales tax pros handles that data with the same care a CPA firm brings to its clients' books. SOC 2 Type II simply puts an independent stamp on it.
A word from our CEO
"When we started Zamp, we knew we were asking businesses to trust us with something that matters: their financial data and their compliance standing in every state they sell. We've never treated security as a feature to add later. It's the foundation everything else sits on. A clean SOC 2 Type II report confirms what our customers already experience every day, and it sets the bar for how we'll keep building as Zamp grows." Rohit Bhadange, CEO and Co-Founder, Zamp
What this means for customers and the firms we serve
For current customers, nothing changes in how Zamp works for you. You now have independent, third-party validation to hand your own auditors, board, or finance team when they ask how your sales tax data is protected.
For businesses evaluating Zamp, vendor security reviews just got faster. Your IT and finance teams can start with an independent SOC 2 Type II report instead of starting from scratch.
For accounting firms and partners, recommending Zamp to clients comes with documented assurance that their data is held to the standards your profession already knows and trusts.
"Our customers and partner firms hand us some of the most sensitive data their businesses have. CFOs and CPAs know exactly what a SOC 2 Type II report with zero exceptions represents, because it's built on the same AICPA standards they work with every day. This gives them one less thing to verify and one more reason to feel confident putting their sales tax in our hands." Matt Grattan, SVP of Revenue and Partnerships, Zamp
See it for yourself
Want the details on how Zamp protects your data? Visit our Trust Center to learn more about our security practices and request access to our SOC 2 Type II report under NDA.
Ready for sales tax that’s fully managed and independently audited? Book a demo and see how Zamp takes compliance off your plate.
