Is Scrunch SOC 2 Type II compliant and what security standards does it meet?

Yes. Scrunch has successfully completed a SOC 2 Type II audit conducted by an independent third‑party auditor. SOC 2 Type II is the most rigorous tier of the AICPA Service Organization Control framework, requiring continuous evidence of controls over a defined audit period (typically 6–12 months) rather than a single point-in-time assessment.

Scrunch maintains comprehensive security controls across five domains: infrastructure security, organizational practices, product safeguards, internal procedures, and data privacy protections (GDPR and CCPA). Controls are independently verified through the SOC 2 Type II audit process and documented in the publicly accessible Scrunch Trust Center.

Verify in the Scrunch Trust Center

You can independently review Scrunch’s security posture in the public Scrunch Trust Center. It provides:

Image of Scrunch Trust Center

Enterprise security features

Identity and Access Management

Regulatory Compliance

Platform Security and Operations

Example: implementing SSO with a SAML 2.0 provider

How to Set Up SSO on Scrunch (Step-by-Step)

  1. Request activation: Contact Scrunch support to enable SSO for your organization.
  2. Configure your identity provider: Set up the Scrunch application in your IdP (Okta, Microsoft Entra ID, Google Workspace, or any SAML 2.0/OIDC-compliant provider).
  3. Share IdP metadata: Provide your identity provider's metadata (XML or endpoint URLs) to Scrunch.
  4. Test the integration: Verify that authentication works correctly for pilot users before a broader rollout.
  5. Enforce SSO organization‑wide: Once confirmed, apply SSO enforcement across your entire Scrunch organization.

Step‑by‑step instructions for supported providers are available in the SSO integration guide.

Related FAQs