viAct 完成 SOC 2 Type II 鑒證，提升客戶信任

As AI video analytics becomes an integral part of workplace safety, protecting the information processed by these systems is just as important as detecting hazards. Construction companies, manufacturers, and industrial operators need assurance that their technology providers have appropriate controls to protect sensitive data, prevent unauthorized access, and maintain reliable operations.

viAct has completed its SOC 2 Type II examination, demonstrating the design and operating effectiveness of controls relevant to Security, Availability, and Confidentiality. The examination covered the platform in 2026, providing independent assurance over the controls implemented and operated during this period.

Beyond achieving this milestone, viAct approach involves technical safeguards across encryption, identity and access management, network security, threat detection, secure software development, and disaster recovery.

What Does viAct SOC 2 Type II Attestation Mean?

SOC 2 (System and Organization Controls 2) is an assurance framework developed by the American Institute of Certified Public Accountants (AICPA) to evaluate controls implemented by service organizations.

A SOC 2 Type I report evaluates the design of controls at a particular point in time. A SOC 2 Type II report evaluates both the design and operating effectiveness of controls over a specified period.

viAct SOC 2 Type II examination covered three Trust Services Criteria:

• Security: Protecting systems and information against unauthorized access, use, or modification.

• Availability: Maintaining controls that support platform availability according to applicable service commitments.

• Confidentiality: Protecting information designated as confidential throughout its lifecycle.

The examination concluded that the controls described for the in-scope platform were suitably designed and operated effectively during the reporting period, subject to the complementary controls identified in the report.

How Does viAct Protect Customer Data Through Security Controls?

viAct uses a layered security approach, often described as defense in depth, combining encryption, identity management, network protection, and data governance controls.

These safeguards help protect information throughout its storage, transmission, processing, and authorized use.

1. AES-256 Encryption and TLS-Secured Data Transmission

Protecting customer information requires security measures for both stored data and data moving between systems.

viAct implements several encryption mechanisms within its covered production environment:

• AES-256 encryption at rest: The production database and associated backups are protected using Advanced Encryption Standard (AES) 256-bit encryption. This helps safeguard stored information against unauthorized access.

• TLS 1.2 and TLS 1.3 in transit: Communications between users and the platform are secured through HTTPS using Transport Layer Security (TLS), helping protect transmitted information against interception and tampering.

• AWS Key Management Service (AWS KMS): Encryption keys are centrally managed, with access restricted through defined Identity and Access Management (IAM) permissions.

These controls help protect customer information across storage and transmission processes while reducing unnecessary access to encryption keys.

2. Identity and Access Management Using IAM, RBAC, and MFA

A secure platform must ensure that access to systems and information is limited to authorized personnel.

viAct applies role-based access control (RBAC) and AWS Identity and Access Management (IAM) to assign permissions according to operational responsibilities.

Its access security measures include:

• Multi-factor authentication (MFA): Adds an authentication requirement for relevant administrative systems.

• Least-privilege access: Restricts permissions according to the resources and functions required for authorized responsibilities.

• Privileged access controls: Administrative access to production infrastructure is subject to controlled authentication and activity recording.

• Periodic access reviews: Permissions are reviewed to identify inactive accounts or access that is no longer appropriate.

• Access deprovisioning: Account removal procedures help prevent continued access when personnel leave or no longer require permissions.

Together, these mechanisms help reduce the risks associated with compromised credentials, excessive privileges, and unauthorized access.

3. Network Segmentation and Infrastructure Protection

viAct cloud-hosted platform uses Amazon Virtual Private Cloud (Amazon VPC) network segmentation to help protect sensitive infrastructure resources.

Network segmentation separates resources according to their operational functions and security requirements. Sensitive application and database components are protected from unnecessary direct exposure to the public internet. Additional network safeguards include restricted communication between resources, controlled network access rules, and periodic reviews of access configurations.

The AI-based platform also separates development, testing, and production workloads to help reduce the risk of non-production activities affecting live services. These measures support attack surface reduction, limiting the number of systems and connections potentially exposed to unauthorized activity.

4. Data Classification, Retention, and Secure Deletion

Protecting information requires more than encryption and access controls. Organizations must also manage how data is classified, retained, and removed.

viAct maintains documented information classification and data retention procedures to support the appropriate handling of confidential information.

These include:

• Classifying information according to its sensitivity and handling requirements.

• Establishing retention periods for different categories of information.

• Applying controlled deletion procedures when information is no longer required.

• Maintaining records of deletion activities according to internal procedures.

Customer-specific retention requirements and deletion arrangements depend on the applicable service agreement and deployment configuration.

This helps support responsible information management throughout the data lifecycle.

How Does viAct Monitor Security Threats and Manage Vulnerabilities?

Security threats can arise from unauthorized access, suspicious system activity, or weaknesses in software. viAct uses security monitoring and vulnerability management tools to identify potential risks and support timely investigation and remediation.

The table below explains the key technologies and how they help protect the platform.

Together, these measures help detect potential security issues, investigate unusual activity, and address vulnerabilities as part of its ongoing security management practices.

How Does viAct Maintain Secure Software Development and Platform Availability?

Security must remain part of the software lifecycle, from development and testing to production deployment and ongoing operations.

1. Secure Development Through Code Reviews and CI/CD Controls

viAct maintains secure development and change management procedures to help prevent unauthorized or untested software changes.

These practices include:

• Code review: Proposed software changes undergo review before being incorporated into protected code branches.

• Controlled change management: Changes are documented and processed through defined development and testing workflows.

• Automated deployment workflows: Continuous Integration and Continuous Deployment (CI/CD) processes support controlled software releases.

• Environment separation: Development, testing, and production workloads are logically separated to reduce unintended operational impacts.

Together, these measures help maintain software integrity and reduce risks associated with application updates.

2. High Availability Through Multi-AZ Infrastructure

Platform availability is particularly important for industrial organizations that depend on timely access to safety monitoring information.

The covered production environment uses Amazon RDS Multi-AZ, a database deployment configuration designed to support availability through infrastructure redundancy. The platform also incorporates infrastructure capacity monitoring and scaling mechanisms to help manage changing workloads.

These measures support service resilience and reduce dependence on individual infrastructure components.

3. Automated Backups and Disaster Recovery Testing

viAct maintains automated backup procedures and documented disaster recovery processes for its covered production environment. Backup controls help preserve recoverable copies of relevant system data, while disaster recovery procedures define how services can be restored following certain operational disruptions.

Recovery testing is conducted to assess the effectiveness of these procedures and identify potential improvements.

These controls support business continuity, although no technical system can guarantee uninterrupted availability or eliminate every possible disruption.

How Does viAct Secure Video Analytics Across Different Deployment Environments?

AI video analytics platforms process information originating from cameras and other connected monitoring systems. The security considerations can vary depending on where video processing and data storage occur.

viAct supports cloud-based, on-premises, and hybrid deployment approaches, allowing organizations to evaluate different architectures according to their operational requirements.

• Cloud-based deployment: Video data can be processed through cloud-hosted services, with monitoring results made available through a centralized dashboard. Security requirements include protected data transmission, access management, and cloud infrastructure controls.

• On-premises deployment: AI inference and monitoring components can operate within a customer's local infrastructure. Security responsibilities include protecting local systems, network connectivity, and access to the deployment environment.

• Hybrid deployment: AI inference can take place on-site while selected supporting services, such as dashboards or training components, operate in the cloud. The information exchanged between these environments depends on the implementation.

The exact processing, storage, transmission, and retention arrangements must be established for each deployment.

Importantly, viAct SOC 2 Type II attestation applies to the system and controls defined within the examination scope, rather than automatically covering every possible customer-specific deployment configuration.

What Does SOC 2 Type II Mean for viAct Enterprise Customers?

For construction companies, manufacturers, logistics providers, and other industrial organizations, selecting an AI video analytics platform requires evaluating both operational capabilities and information security.

viAct SOC 2 Type II attestation provides additional assurance in three important areas.

1. Independently examined security controls

Enterprise customers can review evidence of security controls that were examined for design and operating effectiveness over the reporting period.

2. Greater transparency in data protection practices

The examination provides a structured basis for understanding controls related to encryption, access management, infrastructure protection, availability, and confidential information handling.

3. Support for enterprise vendor risk assessments

IT security, procurement, and compliance teams can use the report to evaluate the covered control environment and understand relevant responsibilities when adopting the platform.

SOC 2 Type II does not eliminate security risks, guarantee future performance, or independently establish compliance with every applicable privacy law. It assures the controls and period defined in the report.

Conclusion: Key Takeaways

• Independent security assurance: viAct SOC 2 Type II attestation confirms that its security, availability, and confidentiality controls were independently examined over a defined period.

• Secure data protection: AES-256 encryption protects stored data, while TLS 1.2/1.3 helps keep information secure during transmission.

• Controlled system access: Role-based access control (RBAC) and multi-factor authentication (MFA) help ensure that only authorized personnel can access sensitive systems.

• Continuous security monitoring: Tools such as Amazon GuardDuty, along with vulnerability scanning and security testing, help detect and address potential threats.

• Reliable platform operations: Automated backups, secure software updates, and disaster recovery procedures help maintain system availability and support recovery from disruptions.

With SOC 2 Type II attestation, viAct strengthens its commitment to protecting customer data and delivering secure, reliable AI video analytics solutions for industrial workplaces.

Quick FAQs

1. What is the difference between SOC 2 Type I and SOC 2 Type II?

SOC 2 Type I evaluates whether security controls are suitably designed at a specific point in time. SOC 2 Type II goes further by examining whether those controls operated effectively over a defined period.

2. What does SOC 2 Type II mean for customers?

SOC 2 Type II means that an independent auditor has examined viAct's security controls over a specific period. It gives customers greater confidence that viAct protects their data, maintains platform availability, and handles confidential information securely.

3. Does SOC 2 Type II attestation mean it is GDPR compliant?

No. SOC 2 Type II and GDPR address different requirements. viAct examination covered Security, Availability, and Confidentiality controls, not a complete assessment of GDPR compliance. Customers should separately review applicable privacy and data protection requirements.

4. How does viAct keep CCTV footage and safety monitoring data secure?

viAct uses encryption, access restrictions, and security monitoring to protect information within its covered platform environment. AES-256 helps protect stored data, while TLS 1.2/1.3 protects information during transmission. The exact handling of CCTV footage depends on the customer's deployment configuration.

5. Why should enterprises consider SOC 2 Type II when choosing an AI video analytics provider?

SOC 2 Type II gives enterprise customers independent evidence that a provider's relevant controls were examined over time. For AI video analytics buyers, it supports security reviews, vendor risk assessments, and procurement decisions involving sensitive operational information.

Read more:

• What Capterra’s New report reveals About AI in Construction Management

• We Asked 4 HSE Leaders Across the GCC What AI Actually Does for Workplace Safety. Their Answers Were Refreshingly Honest