SOC 2® Type II Report Issued

Audited.
Continuously.

ChartVPS holds a SOC 2 Type II report. An independent auditor tested how our security controls operate over a three-month period, not just how they look on paper on a single day.

Check Our Policies

Audit information

Review Period: 3 months
Period: Jun 22 – Sep 22, 2026
Report Date: Oct 29, 2026
In-Scope Controls: 71
Auditor: Prescient Assurance
Re-Audit Cycle: Annual

Operational Controls

Identity & Access

SSO, MFA on all remote and admin access, least-privilege RBAC, quarterly access reviews.

Quarterly Access Reviews

Change Management

Every production change is documented, peer-reviewed, tested, and formally approved before deployment.

Auditable Change Logs

Logging & Monitoring

Centralized audit logging with intrusion detection and file-integrity monitoring; alerts on anomalous or tampered logs.

Audit Logging + IDS

Disaster Recovery

Documented recovery procedures with automated environment replication. DR plan tested at least annually.

Annual DR Test

Vulnerability Management

Vulnerability scanning at least annually plus periodic external scans, findings tracked to resolution, and regular penetration testing.

Regular Pen Testing

Incident Response

Defined severity levels, incident notification timeframes, post-incident reviews shared on request.

Defined Response SLA

The difference between paperwork and proof.

Type I confirms controls exist. Type II confirms they work, day after day, for months. ChartVPS holds both.

Point in time

SOC 2 Type I

Auditors verify that controls are designed correctly on a single point in time. A snapshot. Most VPS providers stop here.

Point-in-time review
Controls exist on paper
Single audit window

Over time

SOC 2 Type II

Auditors observe whether controls actually function over a sustained window. Continuous evidence collection. The real validation.

Operational over time
Evidence tested across the full period
Independent re-audit annually

ChartVPS vs Others

Where competitors fall short

Criterion	ChartVPS	Generic VPS providers
SOC 2 Type I	Report issued	Often absent
SOC 2 Type II	Report issued	Often absent or Type I only
Trust criteria	Security · Availability · Confidentiality	Unscoped
Evidence window	3-month review period (Jun 22 – Sep 22, 2026)	Snapshot only
Auditor	Prescient Assurance	Self-attestation or none
Customer-facing report	Type I and Type II reports under NDA via trust center	Marketing PDF, if any
Incident notification SLA	Defined · published	Best-effort
Access reviews	Quarterly, evidenced	Ad-hoc
DR testing	At least annual, results logged	Untested
Encryption policy	AES-256 at rest, TLS 1.2/1.3 in transit	Varies per node

Trust, demonstrated — not described

Request our SOC 2 Type II report or talk to our security team.

✓ SOC 2 Type II Report✓ Security Overview✓ Incident Response Summary✓ Encryption Standards

Request report Contact support

Frequently Asked Questions

Type I checks that controls are designed correctly at a single point in time. Type II goes further: an independent auditor observes whether those controls actually operate over a sustained window, with evidence collected continuously. ChartVPS holds both a Type I and a Type II report, with annual re-audits from here on.

Yes. Our SOC 2 Type II report is available under NDA, typically within one business day of your request. Request access through our trust center or ask your account manager.

Prescient Assurance, an independent licensed CPA firm, performed the audit. It covers 71 in-scope controls across the Security, Availability, and Confidentiality trust criteria, tested over the period June 22 to September 22, 2026, with annual re-audits.

Data is encrypted with AES-256 at rest and TLS 1.2/1.3 in transit. Encryption policy is applied consistently across the fleet rather than configured per node.

We run defined incident severity levels with published notification timeframes. Disaster recovery is tested at least annually with results logged, and post-incident reviews are shared on request.

Audited.Continuously.