SOC 2 Type II Certified
QG MED holds SOC 2 Type II certification, independently verified by the AICPA, proving our controls for security, availability, and confidentiality operate effectively over time.
What is SOC 2?
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of CPAs (AICPA). It defines criteria for managing customer data based on five "trust service principles": security, availability, processing integrity, confidentiality, and privacy.
Type I reports assess whether controls are suitably designed at a specific point in time. Type II — the more rigorous certification we hold — assesses whether those controls operated effectively over an extended period, typically 6–12 months.
SOC 2 Type II is considered the gold standard for service organizations handling sensitive customer data, particularly in healthcare and technology sectors.
The Five Trust Service Principles
1. Security
Systems are protected against unauthorized access, both physical and logical.
2. Availability
Systems are available for operation and use as committed or agreed.
3. Processing Integrity
System processing is complete, valid, accurate, timely, and authorized.
4. Confidentiality
Information designated as confidential is protected as committed or agreed.
5. Privacy
Personal information is collected, used, retained, disclosed, and disposed of appropriately.
Why Type II Matters More
Unlike Type I (a snapshot in time), our SOC 2 Type II report covers an extended audit period, meaning an independent auditor has verified that our security controls:
- Operated consistently and effectively throughout the audit period
- Were not just designed correctly but actually followed in practice
- Detected and responded to security events appropriately
- Maintained availability and performance standards over time
- Protected confidential customer data on an ongoing basis
What This Means for Our Customers
When you shop at QG MED, your data — including your name, address, payment information, and order history — is protected by controls that have been rigorously tested and verified by an independent third party. This certification is especially important in the healthcare industry, where the confidentiality and integrity of data is paramount.