SOC 2 at Citation
Independent assurance about the controls supporting Citation’s service.
Scope at a glance.
- Framework
- SOC 2
- Status
- Audited
- Applies to
- The service boundary and Trust Services Criteria defined in the independent audit report.
Read this alongside the security controls and provider list for the features you plan to use.
Security controls with independent assurance
Citation’s SOC 2 audit provides information about the controls covered by the examination. The report is the reference for the system boundary, the auditor’s opinion and the criteria included in the engagement.
For a vendor review, request the report and examine its scope against the services your organization intends to use. The relevant questions include which systems are covered, what responsibilities remain with customers and how external providers fit into the service.
How this connects to your workspace
Citation checks account identity and access permissions for protected operations. Workspace membership, document invitations and public sharing settings determine who can work with a document. Connections to external tools use their own permissions.
Our security overview describes these application controls. The SOC 2 report provides the separate assurance context for the controls included in the audit; it does not replace the need to configure your own accounts and sharing appropriately.
Request the report
Contact us with your organization name and the purpose of your review. We can discuss report access, confidentiality requirements and any questions about the applicable scope. Use the report itself for the auditor, examination period and report type.
Documents for a useful review.
Ask for the information that establishes the relevant scope, period and responsibilities.
- Auditor’s opinion, report type and examination period
- System description and included Trust Services Criteria
- Testing results, exceptions and management responses
- Subservice organizations and complementary customer controls
Include your organization, intended workflow and procurement requirements when requesting access. Some documents may require confidentiality arrangements.
Your part in the workflow.
- Compare the report period and system scope with the service you are buying.
- Review any customer controls that depend on your account, members or sharing settings.
- Request clarification about changes after the report period and any applicable bridge information.
For personal information requests, use Data requests. For a suspected incident, follow the security reporting process.