Nexl completes SOC 2 Type II audit

Nexl has completed its SOC 2 Type II audit, an independent review of how we protect law firm data. As a CRM built for law firms, Nexl handles some of your firm’s most valuable relationship data. For BD and marketing teams, the SOC 2 Type II report makes it easier to get new technology through IT and risk reviews. It also gives you a clear, independent answer when clients or partners ask how that data is handled.

What a SOC 2 Type II report covers

A SOC 2 Type II report is an independent audit that tests whether a technology provider’s security controls worked effectively over several months of real operation.

SOC 2 is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA). It sets out how technology providers should protect the data they handle for their customers. Providers are measured against five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Security is required in every report, and providers choose which of the other criteria apply to their services.

An independent CPA firm carries out the audit and reports on its findings. A Type I report assesses whether controls are designed appropriately at a single point in time. A Type II report, often written as SOC 2 Type 2, tests whether those controls worked effectively over an observation period, usually three to twelve months.

How SOC 2 Type II and ISO 27001 work together

ISO/IEC 27001:2022 is an international standard for managing information security, and certification confirms that a company’s overall approach meets it. A SOC 2 Type II report looks closely at the performance of specific security controls over a set period. You can review Nexl’s SOC 2 Type II report and ISO/IEC 27001:2022 certification at trust.nexl.cloud.

Simpler security reviews for your IT and risk teams

Vendor security reviews often slow down technology decisions at law firms. Security teams regularly ask vendors for a SOC 2 Type II report because it shows an independent auditor has tested the vendor’s controls over months of operation. Your IT and risk teams can use that evidence, together with our ISO/IEC 27001:2022 certification, to answer many of the questions in their assessment. That means fewer rounds of back-and-forth before your firm can move ahead.

Confidence when your clients ask

Clients, particularly financial institutions and large corporations, set clear expectations for how their law firms handle data, and many extend those requirements to the firm’s technology providers. When a client asks how your relationship data is protected, you can point to an independently audited SOC 2 report and our ISO 27001 certification.

Support for a firmwide rollout

Nexl captures relationship data automatically from email and calendar metadata, which lets lawyers see who knows who across the firm with zero data entry. Partners want to know that data is handled carefully before they support a firmwide rollout. Independent assurance gives BD and marketing leaders a clear answer when that question comes up, and it makes internal sign-off easier to secure.

Getting a copy of our report

Current customers and firms evaluating Nexl can request our SOC 2 Type II report at trust.nexl.cloud. You can also find our subprocessors and security controls in the same place. Our team is also happy to work with your team on security questionnaires and vendor assessments. If you'd like a closer look at how Nexl could help securely turn your firm's relationships into growth, book a demo with our team.

‍