Our commitment to security
Risk registers, cost estimates and project schedules hold sensitive information. Outside auditors check how we protect what our clients trust us with, and you can read their reports under NDA.
Audit record
AttestedOctober 2026
Audited by Sensiba
CertifiedMarch 2026
Audited by Sensiba
AttestedJuly 2025
Audited by AssuranceLab
Reports are available on request under NDA.
How we got here
Each audit was carried out by an outside firm, and each one built on the last.
An independent auditor confirms that the controls, policies and procedures we use to protect customer data and keep our systems reliable are designed and in place. It is the first step on our security roadmap.
The Type II audit goes further. It tests the same controls over three months, from 26 June to 26 September 2025, and confirms that they operated effectively throughout, not only on the day of the audit.
An external Stage 2 audit evaluates the design, implementation and effectiveness of our information security management system. We receive our ISO/IEC 27001:2022 Certificate of Registration.
Our second Type II report covers 12 months, from 27 September 2025 to 26 September 2026. In the auditor's opinion, our controls again operated effectively throughout. Together, the two Type II reports cover every day from 26 June 2025 to 26 September 2026.
What the audits cover
SOC 2 is an audit framework from the AICPA. ISO/IEC 27001 is the international standard for information security management systems.
Set by AICPA, the American Institute of Certified Public Accountants
Set by AICPA, the American Institute of Certified Public Accountants
Set by ISO and IEC, the international standards bodies
For our users
Independent proof that your data with Vose is protected, available and handled with integrity.
Your security team can rely on independent audit reports instead of taking our word for it, which reduces the due diligence needed to approve Vose as a supplier.
Our latest SOC 2 Type II report shows that our controls worked throughout a full 12 months, not only on the day an auditor visited.
SOC 2 and ISO/IEC 27001 are widely used compliance frameworks, so our evidence lines up with the questions your own risk and compliance teams ask.
ISO/IEC 27001 asks us to keep assessing information security risks and improving our controls. We treat certification as the start of that work.
Your data
Three of our four products run on your own computers. Pelican runs in our cloud or on your own servers, as you prefer.
Excel add-ins that you install on your own Windows computers, or from a shared folder on your network. Your models are ordinary Excel workbooks, saved wherever your organisation keeps its files.
System requirements →
A desktop application for Windows, installed on your computers or your network. The schedules you import from Primavera or Microsoft Project, and the risk analyses you build on them, stay in your own files.
System requirements →
Use Pelican as a cloud service in any modern browser, or install it on your own network with Windows Server, IIS and Microsoft SQL Server. Pelican keeps current and past values, so every change to risk data is logged.
Pelican risk register →We process personal data under the EU General Data Protection Regulation (GDPR), over encrypted connections and with access controls. We do not store card details: online payments go straight to our payment provider.
Privacy statement →FAQ
Yes. Independent auditors attested our controls under SOC 2 Type I in July 2025, and under SOC 2 Type II in October 2025 and again in October 2026. The latest Type II report covers the 12 months from 27 September 2025 to 26 September 2026, and in the auditor's opinion the controls operated effectively throughout that period.
Yes. Vose Software was certified to ISO/IEC 27001:2022, the international standard for information security management systems, in March 2026, after an external Stage 2 audit.
Both are available on request under NDA. Contact our sales team or write to info@vosesoftware.com. The Vose Trust Center shows our current security posture and compliance status.
Type I checks that controls are suitably designed and in place at a point in time. Type II tests the same controls over an audit period and confirms that they operated effectively throughout.
ModelRisk, ModelChoice and Tamara install on your own Windows computers or network, and your models and schedules are files you keep. Pelican runs as a cloud service in the browser, or on your own servers if you install it locally.
Under the EU GDPR, as our privacy statement sets out. Service providers that process personal data on our behalf are bound by data processing agreements under Article 28 of the GDPR, and we do not sell personal data.
Ask for our SOC 2 Type II report or ISO/IEC 27001 report under NDA, or see our current security posture and compliance status in the Trust Center.
