WorkMagic is now SOC 2 Type II compliant
by
Daniel Oh, Director of Product Marketing
Independent verification that the data behind your measurement is handled the way we say it is.
WorkMagic has achieved SOC 2 Type II compliance in accordance with American Institute of Certified Public Accountants (AICPA) standards for SOC for Service Organizations (SSAE 18). The audit was performed by Prescient Security, and covered the period March 20, 2026 through June 20, 2026.
Why this matters for the brands we work with
Our entire product rests on a premise: marketing decisions should be based on measured causal impact, not assumption. Geo incrementality tests, incrementality-calibrated MMM, causal attribution, all of it exists because "we think this channel is working" isn't good enough when real budget is on the line.
To do that work, brands connect us to some of their most sensitive systems: order and revenue data, store-level performance, and ad platform accounts across Meta, Google, TikTok and more. That's a meaningful amount of trust, and it deserves the same exacting treatment we give measurement claims.
What SOC 2 Type II actually confirms
There's a real difference between Type I and Type II, and it's worth being precise about it.
A Type I report evaluates whether controls are appropriately designed at a single point in time. A Type II report evaluates whether those controls operated effectively throughout an observation period. Prescient Security, an independent auditor, tested our controls across that window and reported on how they performed in practice.
Our report covers the Trust Services Criteria for Security. Controls tested included:
Logical access provisioning, least-privilege permissions, and periodic access reviews
Encryption of customer data at rest and in transit
Vulnerability scanning across production infrastructure
Documented incident response procedures
Change management and secure development practices
Vendor risk management, including collection and review of vendor SOC 2 reports
Background checks and security awareness training for personnel
Encrypted backups with defined retention, and business continuity and disaster recovery procedures
WorkMagic's production environment is hosted on AWS, which is treated as a subservice organization under the carve-out method. This is standard practice for cloud-hosted platforms.
What this means if you're evaluating WorkMagic
If you're in procurement, security review, or legal at a brand considering WorkMagic, this should shorten your path. Our SOC 2 Type II report is available under NDA - if you'd like to see a copy, reach out to your WorkMagic CSM.
If you're already a customer, nothing changes in how you work with the platform. The controls you were relying on are now independently attested.