What SOC 2 and HIPAA are, what the audit verified, and what it means if you are evaluating us as a partner.
OrangeLoops has successfully completed its SOC 2 Type I audit and its HIPAA compliance program. For every company we work with, SOC 2 means an independent auditor has verified how we protect their code, data, and intellectual property. For companies building around health and wellbeing data, HIPAA means we can act as a Business Associate and sign BAAs.
Companies hand us their source code, their credentials and their intellectual property every day. Writing "we take security seriously" on a website costs nothing. So instead of asking clients to take our word for it, we invited an independent auditor to verify it.
What SOC 2 is
SOC 2 is the security standard US companies rely on to evaluate the vendors who touch their code, systems and data. It was created by the AICPA (the American Institute of Certified Public Accountants) and is built on a set of standards called the Trust Services Criteria.
What gives SOC 2 its weight is how it is earned. No company can grant it to itself. A licensed, independent CPA firm examines the company's policies, tools, processes and evidence, and issues a formal report with its professional opinion. That report is exactly what buyers ask for when they request a vendor's SOC 2, and it is what we now share with clients and prospects under NDA.
SOC 2 is voluntary, which is part of why it carries weight: companies go through it because they want their security practices verified by someone independent.
Built around what we actually do
A SOC 2 audit is scoped to the services a company provides, so the report verifies what matters to its clients rather than a generic checklist. Security is the foundation of every SOC 2 report. The other criteria are added when they match the business: Availability, for example, is aimed at companies that host and run systems for their clients, and Processing Integrity at platforms that process transactions.
As a software development partner, what we hold for our clients is their code and their intellectual property. So alongside Security, we chose Confidentiality: the criterion that examines how confidential information is classified, protected, shared and disposed of.
Confidentiality is a deliberate choice. A client's codebase is often the most valuable thing the company owns, so we wanted an independent auditor to examine the practices around it: who gets access and how it is approved, the devices and channels it moves through, and what happens to it when a project ends.
Type I today, Type II on the way
SOC 2 is a journey with two milestones, and we have reached the first one.
Type I: the foundation. The auditor reviews evidence such as policies, system configurations, records and signed agreements, and confirms that the right controls are designed and in place across the whole organization. This is where most of the work happens: writing policies, closing gaps and turning controls into everyday habits. It is the milestone every company reaches first, and it is the one we have completed.
Type II: proof over time. The auditor observes the same controls over several months and tests random samples from that period, such as onboardings, offboardings and access reviews. It is the report most enterprise buyers ultimately look for, and it is our next milestone, with the audit planned for March 2027.
Type I shows our controls are built right. Type II will show they keep working, month after month.
HIPAA, and who it is for
HIPAA is the US law that protects health information. Providers, insurers and health plans can only share it with vendors who meet HIPAA's safeguards and sign a BAA (Business Associate Agreement). That reaches well beyond hospitals: digital health startups, telehealth and care-navigation apps, and wellness, fitness and wearable companies once they partner with a provider, insurer or employer health plan, for example to offer bloodwork or bring lab results into their product.
We completed our HIPAA compliance program, so we can sign BAAs with safeguards in place on our side: trained people, protected devices, controlled access, and a defined process for reporting incidents.
How we work with health and wellness clients also matters:
- We build and maintain their software.
- We don't access their production environments.
- We work with test data whenever possible. When a project requires health data, we handle it under a BAA with HIPAA safeguards.
We avoid handling real patient data whenever possible, which means less risk for the client. And when a project could potentially involve it, HIPAA-level discipline is already in place on our side.
SOC 2 and HIPAA overlap, but one does not replace the other. SOC 2 is a voluntary audit of a company's controls; HIPAA is a legal requirement for anyone handling health data on behalf of a covered organization. Health and wellness companies usually need both.
What's behind the report
These are the practices the audit examined, in plain language. The codes in parentheses are the Trust Services Criteria each one maps to, for security teams who want the detail.
- Vetted, committed people (CC1.4, CC1.1). Every team member is verified before getting access (identity, references and background checks where the law allows) and signs our Code of Conduct and an NDA.
- Security training for everyone (CC2.2). Security training at onboarding and every year, plus clear rules for handling client data and using AI tools.
- One identity, always with MFA (CC6.1). Each person has a single corporate identity with multi-factor authentication. No shared accounts and no plain-text passwords: credentials live in a managed vault.
- Managed, encrypted devices (CC6.8, CC6.4). Company laptops are centrally managed, encrypted and protected against malware. Returned devices are securely wiped.
- Access only when needed (CC6.2, CC6.3). Access is requested, approved and granted per project. When someone leaves a project or the company, it is removed, including any access the client gave them.
- Client information is confidential by default (C1.1, CC6.7). Client code, IP, data and credentials are classified as confidential, shared only through approved encrypted channels, and covered by NDAs and contracts.
- A clean close (C1.2). When a project ends, access is revoked, data is deleted according to the agreed retention, and the close-out is recorded.
- A plan for incidents (CC7.3, CC7.4). A documented incident response plan with roles, containment steps and agreed timelines for notifying the client.
- We vet our own vendors too (CC9.2). Critical vendors and tools, including AI providers, are assessed before use and reviewed every year.
- Leadership owns it (CC1.2, CC3.2). A standing Risk Committee oversees security and risk, with a risk register reviewed at least once a year and an owner assigned to every control.
What the report covers
Every SOC 2 report has a defined scope, and security teams value knowing exactly what was verified. Ours covers:
- Our people: hiring, onboarding, training and offboarding
- Corporate identity, access management and devices
- Our internal tools and how we protect information in them
- Risk, vendor and incident management
By design, it does not extend to client environments, which remain under each client's own controls.
How we got here
The program was a team effort across delivery, engineering, people and security. I led it as Delivery Manager, working with Daniel Gómez (CTO and Security Officer), Paula Moreno (Head of People) and Victoria Gonzalez (our external security consultant). We ran it through Thoropass, which provided both the compliance platform and the independent audit. From kickoff in June to the auditor's opinion took three to four months.
For the team, the program mostly formalized and tweaked practices we already followed, and added new routines such as a standing Risk Committee.
AI helped us move faster through the work, under the same acceptable-use policy and vendor review that the audit checked. Where existing tools got in the way, we built our own: an onboarding and offboarding checklist that makes sure every access is granted and removed on time, and a device inventory that tracks each laptop's security status, from endpoint protection to MDM enrollment. If you're starting your own SOC 2 journey, we're happy to share what we learned.
What it means if you're evaluating us
The same report answers different concerns depending on who is reading it.
- CTO or VP of Engineering. Your concern: handing your code and credentials to an outside team. What you get: evidence that access to your code is controlled, and removed when someone leaves the project.
- CISO or security team. Your concern: breaches through third parties, among the hardest to see and control. What you get: an independent report to review, instead of a long back-and-forth over self-reported answers.
- Procurement or legal. Your concern: meeting your vendor-risk policies and closing on time. What you get: a requirement you can mark as met. Many questionnaires accept a SOC 2 report in place of dozens of questions.
- Health or wellness tech leader. Your concern: every vendor is potential HIPAA exposure, and many development partners can't sign a BAA. What you get: a nearshore partner that already works with HIPAA safeguards and can sign a BAA.
- CEO, COO or product leader. Your concern: your own customers asking who builds your software. What you get: a vendor that helps you pass your own audits and customer reviews instead of slowing them down.
Common questions
Can we see your SOC 2 report? Yes. SOC 2 reports are shared privately, under NDA, on request. They are never published openly.
Are you "SOC 2 certified"? Yes, in the sense people usually mean: an independent auditor examined us and issued a SOC 2 report, which is how any company demonstrates SOC 2.
Do you have SOC 2 Type II? It is our next milestone. We completed Type I, and our Type II audit is planned for March 2027.
Do you sign BAAs? Yes. We completed our HIPAA compliance program and can act as a Business Associate. Our commitments are outlined in the HIPAA section of our Privacy Policy.
We're a wellness company, not a healthcare provider. Is this relevant to us? Often, yes. If you work with providers, insurers or employer health plans, or plan to (for example, to offer bloodwork or bring lab results into your product), HIPAA can apply to you and to your vendors. And SOC 2 matters regardless, because it covers how we protect your code and IP.
Do you access our production environment or patient data? We don't access production. We work with test data whenever possible, and when a project requires health data, we handle it under a BAA with HIPAA safeguards.
Can you fill out our security questionnaire? Yes, and the SOC 2 report usually answers a good part of it.
How do you handle AI tools with our code? AI assistants are used under an acceptable-use policy, and AI providers go through the same risk assessment as any critical tool. Your own AI policies apply on top of ours.
Who audited you? Thoropass. We prepared on their compliance platform, and their independent audit team performed the audit.
Requesting our report
If you are evaluating OrangeLoops and need our SOC 2 report, a BAA, or help with a security questionnaire, write to contact@orangeloops.com. We share the report under NDA. You can also read how our security program and Business Associate commitments work in our Privacy Policy.
We'll write again when our Type II audit is done, to show that these controls aren't only well designed, but have been working month after month.
