Earthmover Completes SOC 2 Type 2 Certification

We’re pleased to share that Earthmover has completed its SOC 2 Type 2 audit, conducted by Insight Assurance. The report, finalized in June 2026, is available to customers and prospects via trust.earthmover.io.

SOC 2 Type 2 demonstrates operational consistency and maturity

A SOC 2 Type I report is a snapshot: it confirms your controls are designed correctly on a single day. Type 2 is harder: an independent auditor observes those controls operating effectively over a sustained window, typically six months or more. It’s the difference between showing your security policy and proving that you follow best practices.

This certification is the culmination of a maturation process that began several quarters ago, when we realized that the public sector, financial services and enterprise customers Earthmover was increasingly attracting needed us to implement the policies and achieve the certifications that would make it easy for them to choose Earthmover for production systems handling mission-critical data.

Secure by design

The SOC 2 Type 2 process also helped us validate architecture decisions already in place:

• Customer-owned data in customer object storage by default. Array data lives in the customer’s own cloud storage or S3-compatible bucket. Earthmover holds the catalog metadata and the control plane. This architecture is compatible with all major public cloud providers and with customer-owned / on-prem systems.
• Least-privilege, short-lived credentials. Storage access uses scoped, auto-refreshed credentials with a one-hour lifetime, with no long-lived keys stored. Customers can revoke access instantly by editing their own IAM policy.
• Enterprise identity. Customers can choose to enforce MFA policies through their own identity provider.
• Encryption everywhere it matters. TLS 1.2+ in transit; customer-managed encryption at rest for data, envelope-encrypted metadata for the catalog.
• Three-layer audit logging. Every API call, admin action, and authentication event is captured across infrastructure (CloudTrail), application (Datadog), and identity (Auth0), attributable and timestamped.
• Network hardening. VPC-isolated deployment, WAF and DDoS protection. Infrastructure benchmarked against CIS AWS Foundations standards and security verified through penetration testing.

Articulating these attributes through the well-known SOC2 stamp makes life easy for the InfoSec teams evaluating Earthmover as part of the corporate procurement process.

Customers across sectors desire suppliers with trust certifications

Today the largest Earthmover customers generally fall into one of three areas, all of which carefully review their data platform providers:

Public Sector. Government buyers in the US and other countries don’t take the vendor’s word on security controls; procurement processes are built around independent attestations. SOC 2 Type 2 clears a gate that used to require a lengthy custom security questionnaire cycle for every agency engagement, and validates the data-sovereignty guarantees public agencies already want: their buckets, their infrastructure, their region(s) of choice.

Financial Services. Trading desks and risk teams run intense vendor risk assessments and generally require third party audits. When combined with Icechunk’s built-in versioning, such that every model release and every data set is traceable and reproducible, SOC 2 Type 2 gives risk and compliance teams the audit and paper trail they need to feel confident in the selection of Earthmover.

Enterprise. For corporate buyers running security reviews, SOC 2 Type 2 is usually the first document requested. It helps to turn what used to be a lengthy security review process into a checklist item, accelerating procurement that might otherwise stall in legal or security review.

Joining the cohort of startups with SOC2

SOC 2 Type 2 is becoming the baseline expectation across the AI infrastructure landscape, not a certification reserved for enterprise platforms in business for a decade or more. Among startups building AI-driven climate and weather intelligence, companies like Tomorrow.io and Jupiter Intelligence have completed their SOC 2 Type 2 certification. And the broader AI infrastructure layer companies that data platforms like Earthmover increasingly share space with, like Hugging Face, Together AI, and Fireworks AI, have already done the same. When the companies training and serving scientific AI models are held to this bar, the platforms feeding them data need to meet it too.

Resources: trust.earthmover.io

If you’d like to review the full report, reach out to your Earthmover contact or visit trust.earthmover.io.