Saturation Achieves SOC 2 Type 2 Compliance

Saturation, the production budgeting and financial management platform used by thousands of film, television, and commercial productions, today announced it has achieved SOC 2 Type 2 certification. The achievement extends the company's SOC 2 Type 1 certification from a point-in-time review of control design into a sustained examination of how those controls actually operate, and it joins the SOC 1 Type 1 certification earned in April 2026. Saturation now holds three SOC certifications covering both the security of production data and the integrity of the financial reporting built on it.

What Is SOC 2 Type 2 Certification?

SOC 2 (System and Organization Controls 2) is an attestation standard from the American Institute of Certified Public Accountants (AICPA) that examines the controls a service organization uses to protect customer data. It is evaluated against the AICPA's Trust Services Criteria, which cover security, availability, processing integrity, confidentiality, and privacy. An organization selects the categories relevant to the service it provides, and security is included in every SOC 2 examination.

The difference between the two report types is time. A Type 1 report evaluates whether controls are suitably designed as of a single date: the right safeguards exist and are structured correctly. A Type 2 report covers a defined period rather than a single date, and it goes further by testing whether each control operated effectively throughout that period. The auditor does not simply confirm that a control was written down. They sample evidence across the window and report the results of those tests, including any exceptions found.

That distinction is why Type 2 is the report enterprise buyers, studios, and security review teams typically ask for. A Type 1 report answers whether a company built the right controls. A Type 2 report answers whether the company actually ran them, day after day, for months.

Why SOC 2 Type 2 Matters for Production Finance

Productions do not run for a day. A feature can spend eighteen months moving from first budget draft through prep, principal photography, post, and final wrap reconciliation, and Saturation is the system of record for the money across all of it. Point-in-time assurance is a weak match for that shape. A Type 2 examination is measured over a period, which is the same way a production experiences the platform.

The three Trust Services Criteria categories in scope map directly onto what production teams depend on:

• Security. Budgets, vendor banking details, contractor payment records, and cost reports are among the most sensitive documents a production holds. A leaked budget can expose talent deals, unreleased project details, and financier terms.
• Availability. Production schedules do not accommodate downtime. A crew cannot stop shooting because an approval queue is unreachable, and a payroll run cannot wait for a maintenance window. Availability controls are tested against that reality.
• Confidentiality. Studios, financiers, and production companies frequently share one platform while needing strict separation between what each party can see. Confidentiality controls govern that separation.

For studios and enterprise clients running a vendor security review, the practical effect is that Saturation can now answer the SOC 2 Type 2 question directly rather than pointing to a design-only report. For independent productions, the same controls apply without anyone needing to ask.

A Type 1 report says you designed the controls. A Type 2 report says you ran them, every day, and an auditor checked. Productions trust us with their budgets, their banking, and their payments for months at a time, so a report measured over months is the one that actually reflects the commitment.

Jens Jacob, co-founder and CEO of Saturation

What the Certification Covers

The SOC 2 Type 2 examination assessed both the design and the operating effectiveness of Saturation's controls across the security, availability, and confidentiality categories of the Trust Services Criteria. Testing covered the areas of the platform where production data and production money meet: logical access and authentication, role-based permissions and budget access management, change management across the engineering pipeline, encryption in transit and at rest, system monitoring and incident response, vendor management, and the availability of the services productions rely on during active shoots. The examination was conducted in accordance with AICPA attestation standards by an independent CPA firm.

The certification sits alongside Saturation's existing security program: TLS 1.2+ and AES-256 encryption in transit and at rest, role-based access controls, enterprise SSO, multi-factor authentication, annual third-party penetration testing, and continuous vulnerability scanning. FDIC-insured production banking and full audit trail visibility are built into the platform. The company's full security and compliance program is detailed at saturation.io/security.

SOC 2 and SOC 1 reports are restricted-use documents under AICPA standards rather than public certificates. Saturation's full SOC 2 Type 2 report is available to customers and prospective customers under NDA by request to security@saturation.io.

SOC 1 Type 2 remains the next step on the compliance roadmap, extending the financial reporting controls program from a design assessment into the same kind of sustained operational review.

Saturation's SOC Certifications

Saturation holds three SOC certifications. Each answers a different question, and the table below shows what each one covers.

A Type 2 report supersedes a Type 1 for the same scope, since it covers everything the Type 1 assessed and adds the operating effectiveness testing. Saturation holds both SOC 2 reports, and the Type 2 is the current one to ask for.

How Saturation's Compliance Compares

SOC certifications are not common across production software. The table below reflects each company's publicly stated compliance posture as of August 2026, taken from their own security, trust, or product pages. Where a company states it holds a report without naming the type, that is what the table records. "None published" means no SOC report was claimed on those pages, which is not the same as not holding one: Entertainment Partners, for instance, shares its reports only under NDA.

The combination matters as much as the count. SOC 2 addresses how a platform protects data; SOC 1 addresses whether the financial reporting built on that data can be relied upon. Saturation and Entertainment Partners are the only two in this set that hold both, and Saturation is the only one that publicly discloses the certification type for each rather than describing itself as "SOC compliant." For productions where financial controls matter as much as data security, both reports, at a stated type, are the right standard.

Frequently Asked Questions

Is Saturation SOC 2 Type 2 certified?

Yes. Saturation achieved SOC 2 Type 2 certification in August 2026. The examination covered the security, availability, and confidentiality categories of the AICPA Trust Services Criteria and tested both the design and the operating effectiveness of those controls over a defined period.

What is the difference between SOC 2 Type 1 and SOC 2 Type 2?

A SOC 2 Type 1 report evaluates whether controls are suitably designed as of a single date. A SOC 2 Type 2 report covers a defined period and additionally tests whether those controls operated effectively throughout it, with the auditor sampling evidence across the window and reporting the results. Saturation holds both.

Which SOC certifications does Saturation hold?

Saturation holds SOC 2 Type 2, SOC 2 Type 1, and SOC 1 Type 1. SOC 2 covers security, availability, and confidentiality controls. SOC 1 covers internal controls over financial reporting, which is the standard relevant to a platform handling production banking, expense cards, and vendor payments. SOC 1 Type 2 is on the roadmap.

Can I see Saturation's SOC 2 Type 2 report?

Yes. Under AICPA standards a SOC 2 report is a restricted-use document rather than a public certificate, so it is shared under NDA. Customers and prospective customers can request the full report from security@saturation.io.

Does SOC 2 Type 2 cover production banking and payments?

SOC 2 covers the security, availability, and confidentiality of the platform and the data in it, including the systems through which banking and payment workflows run. The controls specific to financial reporting accuracy are covered by SOC 1, which Saturation holds at Type 1 and is extending to Type 2.

About Saturation

Saturation.io is a production budgeting and financial management platform built for film, television, and commercial production. The platform covers the full financial lifecycle of a production, from the first budget draft through final wrap reconciliation, including collaborative budgets, real-time actuals, expense cards, production banking, contractor payments, purchase orders, approval workflows, and reporting. Trusted by thousands of production teams worldwide, Saturation provides the financial visibility and control that productions need from prep through wrap.