Skip to content

Knowledge Base

← Back to Knowledge Base Home

FAQ: Is there an SOC2 audit report to provide to my auditor since I use the School Accounting System-Online option and/or K12Docs?

In accordance with the Statement on Standards for Attestation Engagements (SSAE), organizations are made responsible for the maintenance of an effective system of controls over financial reporting.  The System and Organization Controls (SOC) attestation reports, as mandated by SSAE 16 and SSAE 18, are verifiable auditing reports performed by a Certified Public Accountant designated by the American Institute of Certified Public Accountants (AICPA).

School Accounting System-Online:
Software Unlimited, Inc.’s data management partner, Wizmo, Inc., currently employs Lumen owned data centers, and an SOC2 compliance audit is conducted annually.  For our School Accounting System-Online customers, click here to access the latest SOC2 report.

Software Unlimited, Inc. and our data center partner, Wizmo, Inc., have taken steps to ensure the School Accounting System-Online environment is secured and controlled.  In addition to key aspects listed below, click here to download documents created to address questions regarding security protocols, physical security of the data center, and safety of personal information in the hosted environment.

  • Database Separation:  Wizmo has gone to great lengths to ensure end users from “School A” cannot access data from “School B”.  In the event an end user’s credentials are stolen, only that respective School may be affected and not the entire environment.
  • Controlled Access:  Software Unlimited, Inc. restricts Support user access to school data; only two Software Unlimited, Inc. leadership personnel have access to your online data containing sensitive information.
  • Order Processing Safeguards:  School Accounting System-Online user accounts are not automatically generated.  New user accounts go through an order process, vetted by the School and Software Unlimited, Inc. before Wizmo processes account changes.
  • Wizmo – Least Privilege Access:  Wizmo employees are only granted the amount of privilege to accomplish their job function to limit exposure risk.
  • Malicious File Protections:  No end users or Support users have admin rights in the environment.  The ability to run other code is very limited and controlled (ex. cannot execute .EXEs that have been downloaded to temporary folders).
  • Geographical Restrictions:  Remote access from unauthorized regions, outside of the U.S. and Canada, is strictly prohibited.
  • Multifactor Authentication (MFA) Options:  Software Unlimited, Inc. provides MFA options for both our SAS-Online and Web Link products for an added layer of protection if desired.

K12Docs:
All image documents are stored in Amazon Web Services (AWS) at Amazon’s East-2 and Ohio Regions.  All data is encrypted in transit and at rest.  Here is a link to the third-party data center housing our K12Docs instance that is on Amazon Web Services network.  The links to security and compliance information is down the right-hand side.  Click here for SOC and HIPPA information.  Click here for information regarding SOC for AWS.  Software Unlimited, Inc.’s document management partner, Intellinetics, Inc., currently employs Expedient and Amazon Web Services (AWS).  For our K12Docs customers, click here to access the latest SOC2 report.

We take the security of your data seriously and are committed to maintaining a secure environment for all our customers.  If you have further questions or would like more detailed information about our security protocols, please do not hesitate to contact Customer Support at support@su-inc.com regarding any questions.