Are you SOC 2 and ISO 27001 compliant?

SOC 2 Type II covers how controls operate over time — access management, change management, monitoring, and incident response — rather than a point-in-time snapshot.

ISO 27001 covers the information security management system as a whole: risk assessment, policy, training, supplier management, and continual improvement.

C2PA is the content provenance standard that binds capture metadata to the media itself, which is what makes an inspection photo independently verifiable.

GDPR and CCPA govern personal data: lawful basis, residency, subject access, and deletion.

Access is role-scoped and logged, changes are reviewed and tracked, media carries provenance metadata, and personal data can be exported or deleted on request within the statutory window.

Data residency options let EU and Canadian customers keep media in-region.

Security review packs, DPAs, subprocessor lists, and architecture summaries are available to prospects and customers under NDA where applicable — contact us and we will route it to your security team directly.

Each framework has a dedicated page explaining scope, controls, and what it means for your workflow.

Virtual Inspection Pro’s security programme is built around SOC 2 Type II and ISO 27001 controls, C2PA content provenance for captured media, and GDPR and CCPA obligations, including DPAs, data residency, and deletion rights. This describes the programme’s foundations; it does not, by itself, confirm a completed SOC 2 Type II examination or current ISO 27001 certification.

SOC 2 Type II reporting addresses control design and operating effectiveness over a specified period. ISO 27001 sets requirements for an information security management system; certification applies to a defined scope. Agencies evaluating SOC 2 Type II inspection software should request available assurance evidence, check dates and service coverage, and have security reviewers assess exceptions and customer responsibilities. Do not treat a framework reference as a substitute for reviewing the evidence relevant to your deployment.

Before uploading inspection records, identify the information your workflow will collect: participant details, property addresses, interior imagery, documents, and potentially sensitive background information. Assign an owner for each data category and document who needs access. Government agencies, insurers, and lenders should separate vendor security review from approval of the inspection process itself.

Ask which contractual and technical arrangements address processing purposes, subprocessors, storage locations, support access, retention, and deletion. Where a data processing agreement is required, have procurement and privacy teams review it before deployment. Treat data residency as a question about the entire processing arrangement, not just primary storage. For GDPR and CCPA compliance planning, determine applicable responsibilities rather than assuming every organisation or record has identical obligations. Confirm the supported arrangements in writing; the supplied security statement does not specify hosting regions, retention periods, or deletion timelines.

C2PA Content Credentials provide a framework for cryptographically verifiable provenance assertions associated with digital content. They can help reviewers evaluate recorded origin and history, but they do not establish that a depicted condition is true, complete, or sufficient for an inspection decision. A valid provenance record is not a substitute for inspecting the underlying media.

For example, an insurer reviewing water damage may receive images showing a stained ceiling while the concealed pipe remains inaccessible. The reviewer should check the available provenance information, confirm the property and inspection context through the approved workflow, and identify missing views. Ask how provenance is attached, validated, preserved on export, and presented when unavailable; do not assume every downstream tool retains it. Escalate contradictory evidence to a human reviewer. Arrange an in-person visit when concealed conditions, safety concerns, or insufficient visibility prevent a defensible assessment.

Run a limited workflow review before routine use. Give participants clear instructions about what to show and what to keep out of frame, such as identification documents, unrelated occupants, or confidential paperwork. Establish who receives privacy requests, how identity is checked, and who decides whether records can be deleted or must be retained. GDPR erasure rights have exceptions; deletion should not be promised without assessing the request and applicable requirements.

For a property team, a practical test is a resident requesting deletion after a maintenance inspection has become part of a dispute. Route that request to the designated privacy or records lead, check relevant retention requirements, and document the decision and response. Separately, require human review when provenance is missing, evidence conflicts, or the inspection cannot answer the operational question. Security controls support trustworthy handling; they do not determine inspection sufficiency, legal compliance, or whether a record will be accepted in proceedings.