Marble has completed a SOC 2 Type II audit conducted by Prescient Assurance LLC (Prescient Security). The auditor's opinion, issued August 31, 2026, confirms that our controls were suitably designed and operated effectively throughout the observation period against the Security Trust Services Criteria. The report covers the Marble System and the products built on it, including SettLiT and Medchart.
For a company whose entire job is moving sensitive health data with the right authorization, identity, and auditability, this is not a badge. It is the point.
Marble is the infrastructure underneath SettLiT and Medchart. The Marble platform supports health data workflows across both products. That is why we audited the Marble System rather than any single product. The same SOC 2 report covers both SettLiT and Medchart.
What SOC 2 Type II means
SOC 2 is the AICPA's framework for evaluating the controls service organizations use to protect customer data and operate securely. There are two types. A Type I report evaluates whether controls are suitably designed at a specific point in time. A Type II report evaluates whether those controls are suitably designed and operating effectively throughout a defined observation period.
Marble's observation window ran from February 17 to May 18, 2026. During that period, independent auditors tested our access controls, change management, encryption, monitoring, incident response, vendor management, and personnel security against the Security Trust Services Criteria. The result is an attestation that the controls we describe are the controls we run.
That distinction matters if you are evaluating an infrastructure partner. Anyone can write a policy. Type II shows the policy survived contact with three months of real operations.
Why this matters for the people who build on Marble
Marble connects businesses to health information for over 250 million individuals across North America, retrieving consent-based records directly from hospitals, clinics, payers, and government exchanges. The organizations on the other side of those connections, from EHR vendors to state health information exchanges to national frameworks like TEFCA, extend access based on trust. That trust is organizational as much as technical.
SOC 2 Type II gives every partner in that chain, and every customer building on Marble API, Medchart, or SettLiT, the same independent evidence:
- Data is encrypted in transit and at rest, and access is governed by role-based, least-privilege controls.
- Every data transmission produces an audit trail.
- Changes to production are reviewed, tested, and logged.
- Security incidents follow a documented, tested response process.
- The people with access to systems are vetted, trained, and monitored.
For enterprise security teams, this shortens vendor review. For developers, it means the compliance groundwork is already done underneath your application. For the networks we participate in, it is proof that the standards we help shape are the standards we live by.
How we got here: more than a year of work for a three-month window
The observation period lasted three months. Getting to the start of it took more than a year.
SOC 2 Type II is not a form you fill out. It is a standard you have to become. For a company operating at the intersection of health data, legal, and cross-border interoperability, that meant looking at every system, every vendor, every policy, and every person with access, and asking whether we could prove, not just say, that it was handled correctly.
Roughly, the road looked like this:
Readiness. Before any auditor was engaged, we mapped our existing controls to the Trust Services Criteria, identified the gaps, and closed them. Some of that was policy work: formalizing what we already did into documented, reviewable procedures. Some of it was engineering: hardening infrastructure, tightening access, making sure logging and monitoring covered everything that touches sensitive data.
Instrumentation. We brought in Vanta as our compliance automation platform and connected it to our systems so controls could be monitored continuously rather than checked once. In early 2026, every employee completed security and privacy training through it, acknowledged company policies, and brought their devices into compliance. Vanta flags drift the moment it happens, which meant small issues got fixed in days instead of surfacing months later in an audit.
The observation window. From February 17 to May 18, 2026, the controls had to demonstrate operating effectiveness throughout the observation period. Prescient Security kicked off the audit in March and began testing. There is no cramming for a Type II. Either the evidence exists for the whole period or it doesn't.
Evidence and review. Through the summer, the auditors worked through round after round of evidence requests, walkthroughs, and follow-ups. Our compliance lead coordinated every request. Our operations team chased down and closed each flagged item. Our engineering team demonstrated that the technical controls were built right and kept right.
The report. Prescient Security issued its opinion on August 31, 2026.
Anyone who has been through this knows the amount of careful, consistent, mostly invisible work it requires. We are sharing the process because we think the people evaluating health data infrastructure should know what stands behind a badge. And because the team that carried it deserves the credit.
What comes next
A Type II report is not a finish line. The next observation window has already begun, and our controls remain under continuous monitoring. We will renew the attestation annually.