Polygon completes SOC 2 Type 1 examination for Open Money Stack

An independent auditor confirmed our security controls are suitably designed for the Polygon Open Money Stack. SOC 2 Type 2 is underway.

We’re proud to share that Polygon Labs has completed a SOC 2 Type 1 examination covering the Security trust services criteria for the Polygon Open Money Stack (OMS) API and dashboard. Schellman & Company, LLC, an independent audit firm, performed the examination and found that Polygon has adopted appropriate security controls for the OMS product.

What the report covers

SOC 2 is an audit framework from the American Institute of Certified Public Accountants. It’s the standard enterprises and financial institutions use to evaluate whether a technology vendor’s security controls hold up, and it’s built around five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

There are two kinds of SOC 2 report. A Type 1 examines whether controls are designed correctly as of a specific date. An independent auditor reviews the provider’s description of how its system works, then assesses whether the controls in place are suitable to meet the commitments the provider makes to customers. A Type 2 report tests whether those controls actually operated over a period of months, with the auditor sampling evidence across the whole window.

What this means for businesses building on Polygon OMS

If your business moves money through Polygon OMS, this changes four things:

• Your security review moves faster. OMS is a vendor your risk and compliance teams have to clear before a single dollar moves. A SOC 2 report is exactly what that process is built to support. Without one, your team has to build its own assurance from scratch through bespoke questionnaires, architecture calls, and sometimes an on-site visit. With one, much of that work has already been done by a party neither of us controls.
• You get evidence you can hand to your own auditors and regulators. Companies moving customer funds get examined, too. When your auditor, your bank partner, or your regulator asks how you assessed the infrastructure underneath your payment flows, a report from a licensed CPA firm is helpful. A vendor security page is not.
• Your engineers inherit no security work. The report states that complementary user entity controls are not required for Polygon to meet its service commitments. Plenty of SOC 2 reports quietly hand obligations back to the customer: configure this, monitor that, rotate these, and the vendor’s controls hold only if you do. Our security controls are robust and stand on their own.
• You have a defensible answer for your own customers. Your businesses and consumers ask you the same questions your risk team asks us. Independent attestation on the infrastructure underneath your product is something concrete to point to.

“Moving real money as a technology vendor means being held to the standards real financial institutions are held to. Most crypto infrastructure has never been audited against those standards for the systems customers actually integrate with. We choose to be. Type 1 confirms our controls are designed correctly. Type 2 will confirm we run them every day.”

– Marc Boiron, CEO, Polygon Labs

Our security roadmap: SOC 2 Type 2 is next

Moving real money as a technology service provider means being held to high standards. That is the bar we’re building against, and a Type 1 report is a checkpoint on the way rather than the finish line.

SOC 2 Type 2 is already underway. It covers the same controls, tested over a period of months instead of confirmed on a single date, which makes it the harder and more useful claim: not that our controls were designed well, but that we run them every day. Getting there means the process has to hold up on an ordinary Tuesday, not just before an audit.

Our scope will keep growing with the product.

If security review has been the thing holding up a conversation about moving money on Polygon, it’s a good time to restart it.

Interested in moving money with stablecoins? Talk to our team!

---

Legal Disclaimer

This press release is for general informational purposes only and does not constitute legal, financial, tax, regulatory, or investment advice. Nothing contained herein should be construed as a solicitation, offer, or recommendation to buy, sell, or engage with any product or service, nor should it be relied upon as the basis for any decision.

Users and institutions are solely responsible for ensuring that their access to and use of any Polygon product or service complies with all applicable laws, rules, and regulations in their respective jurisdictions. Polygon Labs makes no representation or warranty that any particular program configuration, feature, or use case will satisfy the legal or regulatory requirements of any specific jurisdiction. Users and institutions are strongly encouraged to seek independent legal counsel regarding their specific compliance obligations before engaging with any Polygon product or service.

The features, use cases, and illustrative examples described in this post are subject to applicable law and may not be available in all jurisdictions. All statements regarding future products, features, functionalities, or capabilities are subject to change without notice. Such statements should not be relied upon as representations of future performance or availability.

Polygon Labs reserves the right, in its sole discretion and without prior notice, to modify, suspend, limit, restrict, or discontinue any Polygon product or program in whole or in part, at any time, and all Polygon products and services are subject to the Polygon terms https://polygon.technology/terms-of-use, as well as any terms and conditions specifically governing such product. Polygon Labs further reserves the right to restrict or terminate access to any code, feature, or support for any user or in any jurisdiction where required by applicable legal or regulatory obligations.

Blockchain technology, smart contracts, and decentralized protocols involve inherent and significant risks, including but not limited to technical vulnerabilities, regulatory uncertainty, and potential loss of funds.