Type I to Type II: What’s the Difference?
While our SOC 2 Type I certification confirmed that our security controls were properly designed at a single point in time, a Type II audit goes further — evaluating whether those controls operated effectively and consistently over an extended period. It is the difference between a snapshot and a sustained track record.
This distinction matters enormously to our clients. It means that the security standards we committed to are not aspirational — they are operational, tested, and independently verified.
Why This Matters for Our Clients
Our clients trust us with their most sensitive financial information. That trust is not something we take lightly. The SOC 2 Type II certification is an independent, third-party confirmation that our security practices — from our proprietary bill pay app’s bank-level security and layered access controls, to our 24/7 real-time monitoring managed by our in-house IT team — are not only in place, but performing as intended, day in and day out.
“Achieving SOC 2 Type II is a meaningful progression from our Type I certification. It demonstrates that our security controls aren’t just well-designed — they work, consistently, over time. Our clients deserve nothing less,” said Rob Scherer, President of Plumb.
For RIAs, family offices, and families that rely on Plumb Bill Pay to manage their clients’ financial lives, this certification offers an additional layer of confidence. In a landscape where data security expectations continue to rise, SOC 2 Type II compliance signals that Plumb Bill Pay operates at the highest standards of security and accountability.
Our Ongoing Commitment
This certification is not a finish line, it is a continuation of the work we have always done to protect our clients and their families. From our earliest days, we have built Plumb Bill Pay around the belief that financial peace of mind begins with trust. SOC 2 Type II certification is the latest, and most rigorous, expression of that belief.
We are grateful to our team, our partners at A-LIGN, and most of all to our clients, whose confidence in us drives everything we do.
About A-LIGN
A-LIGN is the leading provider of high-quality, efficient cybersecurity compliance programs. Combining experienced auditors and audit management technology, A-LIGN provides the widest breadth and depth of services including SOC 2, ISO 27001, HITRUST, FedRAMP, and PCI. A-LIGN is the number one issuer of SOC 2 and a leading HITRUST and FedRAMP assessor. To learn more, visit a-lign.com.