SOC 2 Type II and ISO 27001: how WizyVision protects your field data

Every day, thousands of field workers open a WizyVision app on a phone or a rugged device. They photograph a damaged pallet, scan a serial number, complete an inspection checklist on a gas site or record proof of delivery at a customer's door. Each of those actions creates operational data, sometimes sensitive, that leaves the depot, the plant or the warehouse in someone's pocket.

That is why, for most of our customers, the first serious meeting with IT is not about features. It is about trust. Where is the data hosted? Who can access it? What happens if a phone is lost, if an employee leaves, if a supplier is compromised? Until recently, our answer relied on our documentation, our ISO 27001 certification and a great many security questionnaires.

From now on, it also rests on an independent audit report that anyone can request: Wizy Solutions SAS has completed its SOC 2 Type II audit. Here is what that means, and how it fits into a broader approach to security that starts with the field app itself.

WizyVision now holds a SOC 2 Type II report, alongside ISO 27001:2022

Wizy Solutions SAS has received a SOC 2 Type II report from an independent practitioner for WizyVision and Wizy EMM. The audit assessed whether WizyVision's security controls and the related trust services categories were suitably designed and operated effectively over the review period.

This report sits alongside our ISO/IEC 27001:2022 certification, the international standard for information security management systems. The two are complementary: ISO 27001 certifies that a structured, continuously improving security management system is in place; SOC 2 Type II provides an auditor's opinion on how specific controls performed in practice over time.

We prepared for both audits with Bastion Technologies, a compliance platform that also hosts our public Trust Center. Today, 198 security controls are documented and continuously monitored there across 28 domains, from access control and cryptography to business continuity and supplier management.

What this changes for customers, in practical terms:

• Independent evidence rather than a promise. An external auditor, not WizyVision, assessed whether our controls work.
• Shorter security reviews. Your IT and procurement teams can start from an audited report instead of a blank questionnaire.
• Full transparency. You can request both the ISO 27001 audit report and the SOC 2 Type II Reference Letter from our Trust Center, which anyone can access.
• A continuous commitment. We monitor controls on an ongoing basis, not once and then file them away.

Why supplier security has become a buying criterion in 2026

Security questionnaires are not bureaucracy for its own sake. They reflect a real shift in where attacks come from and in what regulators now expect from the companies that buy software.

Third parties are now involved in almost half of all breaches

The 2026 edition of Verizon's Data Breach Investigations Report, based on more than 22,000 confirmed breaches, found that a third party was involved in 48% of breaches, compared with 30% in the previous edition 1.

In other words, your security is now partly determined by the security of every SaaS tool you connect to your information system. A field operations platform that receives photos, locations, asset references and inspection results is no exception.

Breaches are becoming more expensive and slower to contain

IBM's 2026 Cost of a Data Breach Report puts the global average cost of a breach at $4.99 million, up 12% from the previous year. The average time to identify and contain a breach also rose to 247 days, the first increase in five years 2.

The same report highlights a risk that field operations leaders know well: ungoverned tools. Breaches involving shadow AI rose to 43% of organisations studied, against 20% the year before, and 68% of organisations still had no AI governance policy.

Mobile devices and frontline workers are now prime targets

Field teams work on mobile devices, often shared, often outside the corporate network. Verizon's 2026 report notes that phishing click rates are around 40% higher on mobile, making phones attackers' new favourite target. The report also found that 67% of users accessed AI services through non-corporate accounts on company devices.

A field app therefore needs to be secure by design: strong authentication, role-based permissions, encrypted transport and centralised control, so that security does not depend on each worker's vigilance.

Regulation is moving responsibility up the supply chain

In Europe, the NIS2 Directive requires essential and important entities to manage cybersecurity risks in their relationships with direct suppliers and service providers, under Article 21(2)(d) of Directive (EU) 2022/2555 of the European Parliament 3. In practice, this means contractual security requirements, supplier risk assessments and audit evidence.

• In the UK, the Cyber Security and Resilience Bill entered the House of Lords in June 2026. It extends regulation to managed service providers and data centres, allows regulators to designate critical suppliers, and introduces initial incident reporting within 24 hours 4.

Yet supplier oversight is still the exception. In the UK government's Cyber Security Breaches Survey 2025/2026, 43% of businesses (and 69% of large businesses) reported a breach or attack in the previous twelve months. Still, only 15% had reviewed the cyber risks posed by their immediate suppliers 5. Audited suppliers make that review much easier.

Finally, the EU AI Act adds a governance layer for AI-based systems. Under the provisional agreement reached in June 2026, obligations for stand-alone high-risk systems are expected to move to December 2027. The direction is clear nonetheless: buyers will increasingly ask how AI features are governed, logged and controlled.

SOC 2 Type II vs ISO 27001: what each one actually proves

People often confuse the two frameworks and sometimes present them as interchangeable. They are not. They answer different questions, which is why holding both is useful.

What is SOC 2?

SOC 2 (System and Organisation Controls 2) is an attestation framework defined by the American Institute of Certified Public Accountants (AICPA). An independent auditor examines a service organisation's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy.

There are two types of reports:

• A Type I report assesses whether controls are suitably designed at a single point in time.
• A Type II report goes further: it assesses whether those controls operated effectively over a period, typically several months, based on samples and evidence collected throughout that period.

SOC 2 is technically an attestation, not a certification. Its output is a detailed report, which the customer reads and assesses against its own requirements.

What is ISO 27001?

ISO/IEC 27001 is the international standard for information security management systems (ISMS), published by ISO and the IEC. It requires an organisation to define the scope of its ISMS, assess its risks, select and implement appropriate controls (listed in Annex A), and continually improve. The current version is ISO/IEC 27001:2022.

An accredited certification body grants certification after an audit, then maintains it through annual surveillance audits and a full recertification audit every three years.

Comparison table

In short, ISO 27001 shows that security is organised and governed; SOC 2 Type II shows that the controls hold up in practice. Together, they answer most of the questions an IT, security or procurement team will ask a field operations supplier.

What the audits verified at WizyVision: the controls behind the badges

A certificate is only as useful as the controls behind it. All 198 of WizyVision's controls are listed publicly in our Trust Center. Here are the ones that matter most to customers, grouped by theme.

Access control: the right people, and only them

Access to sensitive systems requires multi-factor authentication, and we use single sign-on for sensitive internal systems wherever available. We grant access on the principle of least privilege through role-based permissions, after a documented request approved by a manager. Administrative access is restricted to a small number of people with a clearly defined need, and we review access to customer-confidential systems every quarter. When someone leaves, a termination checklist ensures that equipment is returned and access revoked promptly and completely.

Data protection: encrypted, backed up, and deleted when it should be

Data stores are encrypted at rest, and data in transit over the public internet is encrypted with industry-standard algorithms. We assess TLS configuration every year and promptly correct any grade below A. Customer data is backed up automatically; backups are encrypted, stored in geographically independent regions and protected by the same access controls as the original system. We classify every piece of data and retain customer data according to a documented procedure, then securely dispose of it once the retention period has passed.

Secure development: every change reviewed, every environment separated

We keep production and non-production environments separate. A second technical person reviews and approves every application and infrastructure change before it goes to production. We build change management into our continuous integration and deployment tooling to reduce human error and keep changes auditable. We manage infrastructure as code, scan source code with a static analysis tool, update operating system patches and container images at least weekly, run continuous vulnerability scanning, and have an independent firm conduct an annual penetration test of the production system.

Monitoring and incident response: detect, react, learn

Application and system logs are sent to a centralised logging repository, and security events are triaged and reviewed for unauthorised or malicious activity. A formal security incident management programme defines roles, responsibilities and communication, and it is tested at least once a year. Every incident is tracked and reviewed in a post-mortem. Customers can follow service status on a public status page and are informed of system changes through an established channel.

Business continuity: ready for the worst case

WizyVision maintains a business continuity plan and runs an annual disaster recovery test with predefined recovery time objectives, assuming a full outage of our primary cloud region. Processing facilities are designed with enough redundancy to meet availability requirements.

Suppliers and people: security beyond our own walls

In line with NIS2 requirements, we maintain a supplier inventory, classify the data they process, assess those handling sensitive customer data, and monitor their security posture over time. Every employee and contractor signs a confidentiality agreement before accessing sensitive information; we conduct reference checks where the law allows, and security awareness training is part of everyone's role. A designated Security Officer holds overall responsibility for information security, under management and Board oversight.

Security by design in the field app itself

Audits cover the organisation. But for a field operations platform, security also must work in the depot, on the shop floor and on a gas pipeline, often with no signal.

Field data that is captured, traceable and hard to dispute

Every photo, scan or form recorded in a WizyVision app can be geolocated and timestamped, creating visual proof that is very hard to dispute. This lets customers document the condition of goods on receipt, prove delivery, or demonstrate compliance during an audit.

Offline mode without losing control

Field teams can keep working even in a warehouse dead zone. WizyVision's native mobile app is offline-first: it stores data locally on the device, queues it, then synchronises in the background as soon as the connection returns. Capture keeps going, and the data still ends up in the same governed platform rather than in a spreadsheet or an employee's personal photo gallery.

Governance: no-code is not shadow IT

The concern IT teams raise most often about no-code is legitimate: will business teams create apps nobody controls? On WizyVision, apps are defined as configuration (fields, validation rules, workflows, statuses), which is readable by anyone with the right access rather than locked in one person's code. Users, roles, permissions and audit trails are managed centrally by administrators. Business teams gain autonomy; IT keeps control.

Data does not stay in a silo either. Versioned REST APIs and webhooks feed field data into your ERP, WMS or BI tools.

GDPR and data hosting

WizyVision SAS is based in Paris and has appointed a Data Protection Officer. The platform runs on Google Cloud Platform infrastructure. Our privacy policy lists our sub-processors, explains how long data is kept (for the duration of the service, then twelve months after it ends) and how to request deletion. The contractual commitments of both parties on security and confidentiality are set out in our terms of service and our Master Services Agreement.

AI that is governed, not improvised

WizyVision uses AI to replace typing in the field: OCR, barcode and label recognition, image analysis and app generation from a natural-language description. That AI runs inside the governed platform, with the same permissions, logging, and data controls as everything else. Some models run directly on the device, so capture keeps working without a cloud round trip.

Security in regulated and sensitive environments: what it looks like in practice

Certifications formalise practices our customers have tested for years in demanding environments.

Nuclear: secure image capture at Orano

Orano manages the uranium cycle, from mining to recycling. Photos taken in sensitive nuclear facilities were poorly secured, creating a risk of data leakage, and the group was planning to develop its own mobile capture app. Within a few weeks, Orano's cybersecurity teams validated the WizyVision app and deployed it, configured so no photo remains stored on the phone, with advanced offline mode and annotation tools.

Find out more use cases on our Energy & Utilities page.

Energy: Teréga and Prime Energy

Teréga, which operates around a quarter of gas storage and transmission in France, combines aerial image analysis with a WizyVision mobile app and AI anomaly detection to cut intervention delays by 30%. Offshore in the Philippines, Prime Energy, a Shell subsidiary, digitised inspections of thousands of assets with geolocated, timestamped photos and offline checklists, eliminating paper reports.

Read more on our Energy & Utilities page.

Logistics: audit-ready inspections at Chronopost

For its Fresh/Food deliveries, Chronopost had ISO certifications in place. Its existing digital tool was poorly adopted and complex to administer. WizyVision built an inspection app with simple mobile capture, automatic audit reports and immediate corrective actions. Internal auditors and depot teams adopted it widely, with a software budget 40% lower than the previous solution.

Discover more examples in Transport & Logistics.

These customers chose WizyVision not despite their security requirements, but because the platform met them without slowing the field down. In addition to our certifications, the cybersecurity consultancy Wavestone has also reviewed WizyVision's security.

How to assess the security of a field app vendor: a checklist for IT and procurement

Whether you are comparing platforms or reviewing an existing supplier, these are the questions worth asking. We have added our own answers so that you can check them against our documentation.

How to access WizyVision's SOC 2 report and security documentation

Transparency is part of security. Here is how your teams can review our documentation:

1. Go to the WizyVision Trust Center. It is public and lists our certifications and the 198 controls monitored.
2. Request the documents you need from the Documents tab: the SOC 2 Reference Letter and the ISO 27001 audit report.
3. Check our technical documentation on support.wizyvision.com, which includes security-related articles and guides.
4. Talk to us if your security questionnaire goes further: our team will go through it with you. Contact us.

Security is a commitment, not a badge

SOC 2 Type II and ISO 27001 are not finish lines. They are commitments that are checked again every year, with controls monitored every day. For our customers, that means less time proving a supplier can be trusted, and more time digitising what really matters: the work done in the field.

If your teams are assessing a field operations platform, or reviewing an existing supplier, start with our Trust Center, then let's talk about your use case.