Joshua Douglas, SVP of Product and Engineering
Security isn’t just at the door of our customers, it extends all the way through every touchpoint of our product. This means taking cyber security seriously and is why Xtract One Technologies completed its System and Organization Controls (SOC) 2 Type II audit, verified through an independent CPA examination. The assessment evaluated our internal security controls and data protection architecture across Xtract One View alongside both SmartGateway and Xtract One Gateway hardware. Deploying weapons detection across large facilities requires strong digital safeguards behind physical equipment. Our engineering team designed our technology stack so security staff can manage the physical entry points and have the peace of mind that we are looking after the digital entry points.
Our customers trust our equipment to protect visitors and staff across thousands of daily entrances. Physical security connects directly to digital information protection, which means screening telemetry and administrative communications carry significant operational responsibility. Achieving SOC 2 Type II certification demonstrates our commitment to enterprise security standards across every software update and hardware release. This drastically reduces the onboarding of Xtract One products to allow our customers to work closely with their internal cyber security partners to show they are thinking about the whole business.
Understanding the SOC 2 Type II Standard
The American Institute of Certified Public Accountants established the SOC 2 framework to assess service organizations handling sensitive operational data. While a Type I audit verifies control design at a single calendar moment, a Type II audit evaluates operational effectiveness across an extended observation period. Independent auditors examine system records over several months to confirm that security policies function consistently during live operations.
Auditors evaluated our controls against strict Trust Services Criteria. The assessment verified platform security alongside system availability. Evaluators also reviewed data confidentiality across our cloud infrastructure and connected edge devices. Passing an extended assessment confirms that our technical safeguards operate reliably during routine screening hours as well as high-traffic events.
What Does SOC 2 Type II Compliance Mean for Customer Value?
Meeting third-party audit standards accelerates procurement timelines for hospital systems and commercial campuses. Security officers and IT directors receive documented proof of our operational controls, eliminating prolonged security reviews during pilot programs and system procurement. Risk managers also protect institutional reputations when choosing evaluated suppliers.
Facility operators gain verified assurance regarding cloud data protection as executives using Xtract One View know operational telemetry remains guarded against unauthorized exposure. Security teams can focus on managing arrival lines while trusting our digital controls to safeguard historical logs.
Enterprise Data Protection for Connected Weapons Screening
Physical weapons screening produces meaningful operational information:
- Sensor arrays generate walkthrough counts alongside device status records
- Dual sensor pillars scan specifically for unauthorized items while ignoring common personal belongings
- Gateway configurations communicate status reports directly to local screening consoles as well as centralized administrative dashboards
Xtract One View centralizes these operational data streams into a single cloud dashboard. Security directors review lane performance and evaluate alert patterns across venue entry points. The platform tracks screening metrics like Mean Time to Secure so leadership can evaluate operational flow. Protecting these analytics requires strict security hygiene across every connected component.
We’ve implemented multi-layered digital controls throughout our product lineup:
- Sensitive communication between physical pillars and cloud services uses TLS encryption
- Cloud environments maintain AES-256 data encryption for stored telemetry records
- Access to administrative controls follows the principle of least privilege, requiring multi-factor authentication for operational accounts
- Security teams maintain granular control over staff permissions without risking unauthorized system modifications
Our software infrastructure undergoes automated vulnerability scans alongside external penetration assessments. We’ve built automated incident response protocols into operational workflows to address potential network anomalies immediately. Corporate enterprises and sports venues rely on these technical safeguards to keep venue analytics private and protected against outside threats.
Protecting System Telemetry and Privacy
Screening data involves distinct operational responsibilities. Our Gateways detect concealed weapons by analyzing magnetic field disruptions, converting sensor responses into digital threat profiles. The system never collects personally identifiable information from individuals walking through screening lanes. Avatars and directional indicators display threat locations on security screens without capturing facial imagery or storing biometric records.
Operational metrics focus strictly on facility flow and system health. Administrators review peak ingress volumes to ensure lanes operate efficiently during busy shift changes. Systems log throughput rates and equipment status to help supervisors plan secondary screening staff. Documenting these operational metrics supports venue safety while keeping guest privacy intact.
Local storage policies reflect our commitment to minimal data retention. Gateways retain local operational logs for thirty days before automatic removal. Venue analytics transfer securely to Xtract One View for long-term historical analysis, allowing facility managers to review trends without storing excess data on local screening hardware.
We partnered with Scytale to manage our compliance workflows and automate evidence collection across our software ecosystem. Scytale’s compliance hub connected into our cloud architecture, running continuous control checks and surfacing operational data for external auditors.
Continuous Security Engineering and Infrastructure
Completing a SOC 2 Type II examination represents an ongoing operational standard rather than a temporary milestone. Our engineering team maintains automated monitoring across all backend infrastructure and regular policy evaluations ensure our administrative procedures match our expanding technical deployments.
Development teams follow strict secure coding practices during every release cycle. Engineers test software modifications in isolated staging environments before distributing firmware updates to connected gateways. Production deployments require code reviews and automated static security analysis. We protect hardware firmware so field units accept only cryptographically signed updates from authenticated servers.
Role-based access management ensures that technicians and system administrators access only the specific settings required for their duties. Field technicians can calibrate detection levels or inspect sensor connections without accessing broader administrative accounts. Separating operational permissions protects system integrity across diverse client environments.
Meeting enterprise standards requires ongoing vigilance across software development and hardware support. Our team remains focused on delivering verified threat detection while safeguarding the digital systems supporting your facilities.