Choosing a SOC 2 Compliant Loyalty Program Provider: A Buyer's Guide

A SOC 2 report is an independent CPA's examination of a service organization's controls relevant to security, availability, processing integrity, confidentiality or privacy. It is written for customers and business partners who need to assess the risks of outsourcing, which makes it a practical way to check how a loyalty provider protects member data.

A loyalty program holds a lot of personal data: names, email and postal addresses, purchase histories, preferences and points balances that members can redeem for value. When a brand hires a provider to run that program, the provider's controls become part of the brand's own risk. A SOC 2 report is one of the clearest pieces of independent evidence a buyer can ask for, but only if the buyer knows what to check in it and what it leaves out. This guide covers why SOC 2 matters for loyalty programs, what each SOC 2 category means for a program, how to read a provider's report, what SOC 2 does not cover, the questions to ask and how Brandmovers approaches security.

Key Takeaways

Why does SOC 2 matter for a loyalty program?

A loyalty provider handles member data and points with real value, so its controls become part of your risk; a SOC 2 report gives independent evidence of them.

The AICPA describes SOC 2 as an "examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy," for "customers and business partners" who need to "identify, assess, and address the risks" of outsourced services (AICPA, SOC 2 guide).

That matters in loyalty for three reasons:

• Personal data: member profiles combine contact details with purchase behavior, and promotions add entry and receipt data.
• Stored value: points balances can be redeemed, which makes member accounts a target; the guide to preventing loyalty program fraud covers account takeover and points abuse.
• Connected systems: loyalty platforms connect to e-commerce, CRM and point-of-sale systems, so a weakness at the provider can reach other systems.

SOC 2 is one factor in choosing a provider; the guide to choosing a loyalty program provider covers the others.

What do the five SOC 2 categories mean for a loyalty program?

SOC 2 reports address security, availability, processing integrity, confidentiality or privacy; check which ones a provider's report covers and whether they match your program's risks.

The AICPA's trust services criteria are used "to evaluate and report on controls over the security, availability, processing integrity, confidentiality, or privacy of information and systems" (AICPA, 2017 Trust Services Criteria). A report states which categories it covers.

A report that covers only some categories is not a weakness in itself; the question is whether the categories covered match the risks you care about.

How do you read a provider's SOC 2 report?

Check the report type and period, the systems in scope, the categories, the auditor's conclusion, any exceptions, outsourced services and the controls the report expects you to run.

• Type and period: note which report type you have and the date or period it covers, ask the provider to explain what that type means for the assurance it gives, and ask for the most recent one.
• Scope: confirm the report names the company you would contract with and that the systems and services you would use, such as the loyalty platform, promotions and receipt processing, are in scope. A report on a different product or affiliate does not cover yours.
• Categories: see which of the five categories are covered.
• Auditor's conclusion: read the opinion, note any reservations the auditor states, and note who performed the examination.
• Exceptions: look for any controls the auditor found did not operate as described, and read the provider's response.
• Outsourced services: check which services the provider relies on, such as hosting, email or reward fulfillment, and whether the report covers them or relies on those vendors' own reports. If it relies on them, ask for those reports or how the provider monitors those vendors.
• Your responsibilities: note any controls the report expects customers to operate, such as managing your own staff's access to the platform.
• Time since the report: ask how the provider covers the gap between the end of the report's period and today.

A SOC 2 report is evidence about the controls the auditor examined, not a guarantee against incidents. If a provider has no SOC 2 report, ask what independent evidence it does have, such as a PCI DSS assessment, and weigh that against the data the program will hold.

Providers may share the report only under a nondisclosure agreement. A SOC 3 report is not a substitute: the AICPA describes SOC 3 reports as general use reports that "do not provide the same level of detail" as SOC 2 (AICPA, SOC 3). The 30 RFP questions for loyalty platforms include security questions to pair with the report.

What does a SOC 2 report not cover?

A SOC 2 report does not replace PCI DSS for card data, a review of your privacy obligations, fraud controls in the program design or your own controls.

• Payment card data: PCI DSS applies to "Entities that store, process, or transmit cardholder data (CHD) and/or sensitive authentication data (SAD) or could impact the security of the cardholder data environment (CDE)" (PCI Security Standards Council). If the program takes payments, as with paid memberships, or links members' payment cards for earning, ask about PCI DSS separately and which services its assessment covers.
• Privacy law: a SOC 2 report describes controls; it is not a ruling on whether a program meets the privacy laws that apply to it. Some state laws set terms for the vendor contract itself: California requires a business covered by its consumer privacy law that discloses personal information to a service provider for a business purpose to "enter into an agreement" stating it is disclosed "only for limited and specified purposes" (California Civil Code section 1798.100). The FTC notes that "All states, the District of Columbia, Puerto Rico, and the Virgin Islands have enacted legislation requiring notification of security breaches involving personal information" (FTC, Data Breach Response).
• Program fraud: points abuse and fake receipts are controlled through program rules, validation and monitoring as well as security controls.
• Contract terms: incident notice deadlines and the return and deletion of data at the end of the contract are set in the contract, not the report. The FTC advises businesses to "Put your security expectations in writing in contracts with service providers" and to require notice of any security incidents (FTC, Protecting Personal Information).
• Your side: controls at the brand, such as who on your team can access the platform, stay your responsibility.

Which security questions should you ask a loyalty provider?

Ask for the latest SOC 2 report and its scope, exceptions, PCI DSS status, outsourced services, access and fraud controls, incident notice and data handling at contract end.

1. Can you share your most recent SOC 2 report, and what type and period does it cover?
2. Which systems and services are in scope, and are the ones the brand would use included?
3. Which categories does it cover, and were any exceptions noted?
4. Which services do you outsource, and how are they covered?
5. Which controls does the report expect the brand to operate?
6. If the program takes payments or links payment cards, what is your PCI DSS status?
7. How do you control access for the brand's team and your own, and how are permissions set?
8. What fraud controls protect points, receipts and redemptions?
9. How do you notify clients of a security incident, and how quickly?
10. At the end of the contract, how is member data returned or exported, and how and when is it deleted?

How does Brandmovers approach security?

Brandmovers' SOC 2 Type II and PCI DSS compliance is audited by Hancock Askew & Co., LLP, and its platforms include access, permission and fraud controls.

• Assessments: Brandmovers has SOC 2 Type II and PCI DSS compliance, audited by Hancock Askew & Co., LLP. Buyers can apply the checks in this guide to Brandmovers too.
• Fraud protection: BLOYL™, Brandmovers' enterprise loyalty platform, includes built-in fraud protection.
• Access and permissions: BENGAGED™, Brandmovers' B2B loyalty platform, supports role-based access and custom permissions across internal and external channel hierarchies.
• Receipt validation: Brandmovers' ValidSpend™ receipt validation module lists fraud tools including "CAPTCHA, IP rate limiting, whitelist/blacklist filters, domain checks, manual moderation" (Brandmovers receipt validation).

Conclusion

A SOC 2 report is a useful starting point for choosing a loyalty provider, but only if it is read carefully. Check the type, period, scope, categories, conclusion and exceptions; understand which services are outsourced and which controls stay with you; ask separately about PCI DSS, privacy obligations and fraud controls; and ask how the provider covers the time since its latest report.

Sources

• AICPA, SOC 2 Reporting on an Examination of Controls at a Service Organization
• AICPA, 2017 Trust Services Criteria (With Revised Points of Focus, 2022)
• AICPA, SOC 3
• PCI Security Standards Council, PCI DSS
• California Civil Code section 1798.100
• FTC, Data Breach Response: A Guide for Business
• FTC, Protecting Personal Information: A Guide for Business
• Brandmovers, receipt validation