The SOC2 report has controls generally related to the IT infrastructure surrounding anything that is hosted (along with other items), regardless of the actual product. To that end, I presume Sage 100 would be covered.
We have been SOC2 certified for the past three years, and typically, any requests regarding audit requirements are fully satisfied when we provide the SOC2 report. We've never dealt with additional pushback.
We sometimes get asked for a SOC1, but that does not apply to hosting providers.
------------------------------
George Khairallah
CTO / Co-Founder | gotomyerp / Zaptiva / CFOTech
george.k@gotomyerp.com | 877-888-5525
https://gotomyerp.com------------------------------
Original Message:
Sent: 12-13-2024 12:28
From: Brett Zimmerman
Subject: Sage100 and SOC report
Yes, the Sage-endorsed Cloud/hosting partner has already provided the SOC Report and Bridge Letter, but now the client is asking re: Sage 100. But maybe that just also covers Sage 100?
------------------------------
Brett Zimmerman
Net at Work
Greater Boston Area
------------------------------
Original Message:
Sent: 12-13-2024 12:18
From: Sue Bennett
Subject: Sage100 and SOC report
Sage has a caveat with the Sage Endorsed Cloud Partners who host Sage 100, that they would achieve a SOC certification in order to be endorsed by Sage. And it was one of the qualifications for us to be a Sage Hosted Provider in the first place. I don't know how many other Endorsed Hosting Providers have actually gone through the process for getting that SOC Certification (I kinda doubt everyone did that and I'm not sure Sage is following up on everyone either), but we just finished our SOC2 Cert and it took almost a year. But – for anyone who hosts with us, we can provide evidence of the SOC2 cert now.
Sue Bennett/President
P. 503.620.3484 / E. sue@benpor.com
Bennett/Porter & Associates, Inc.
12559 SW 69th Ave / Tigard, OR 97223
benpor.com / facebook / instagram

The information in this email and any attachments is considered confidential. This information may be subject to legal, professional, or other privilege. It must not be disclosed to any person without our authority. If you are not the intended recipient you are not authorized to and must not disclose, copy, distribute, or retain this message or any part of it. Please return this message to the sender immediately and delete any and all copies from your system.
Original Message:
Sent: 12/13/2024 12:07:00 PM
From: Brett Zimmerman
Subject: RE: Sage100 and SOC report
Is this still n/a for Sage 100, even when it's being hosted in the cloud?
Btw, it appears that article above no longer exists in the kb, although I just located this one:
Does Statement of Auditing Standards SSAE 16 or SOC certification apply to Sage products?
Created on | Last modified on
Does Sage provide an SOC 1 (System and Organization Controls) report?
Resolution
Because Sage Products are provided as packaged software solutions rather than as services, SSAE 16, SSAE 17, and SOC 1 (formerly SAS 70) certification doesn't apply.
The Statement on Auditing Standards SSAE 16, SSAE 18, SOC 1, and the previous SAS 70, Service Organizations, is an auditing standard that was issued by the American Institute of Certified Public Accountants (AICPA). The intent of the standard is to provide a guideline to ensure that adequate controls are in place over service organizations and service providers.
SSAE 16, SSAE 18, SOC, SOC 1 and SAS 70 applies when financial statements are audited only if the organization obtains services from another organization. Sage Accounting and specialized solutions (such as Sage X3 ERP, Sage 100 ERP, Sage 50, Sage 500 ERP, Sage Fixed Assets, Sage 300, Sage Pro, and Sage Business Vision) are provided as packaged software solutions rather than as services.
Organizations that use Sage Accounting solutions are always in full control of their data - from establishing access, entering information, and producing reports. While organizations may provide data or reports to Sage for specific projects (for example, Sage Expert Services engagements), no data is ever automatically sent outside of the organization's control. Under no circumstance is Sage represented as a service provider for retrieving, analyzing, and reporting on any organization's information.
**SSAE 16 and SSAE 18 effectively replaced SAS 70 as the standard for reporting on service organizations**
Link to further information: https://www.ssae-16.com/soc-1/
------------------------------
Brett Zimmerman
Net at Work
Greater Boston Area
Original Message:
Sent: 05-05-2023 12:49
From: Wayne Schulz
Subject: Sage100 and SOC report
Does Sage 100 support SOC auditing reports?
Created on 06-14-2022 / Last modified on 03-09-2023
Summary
Does Sage 100 support SOC auditing reports?
Does Sage uses SOC 2 Bridge Reports?
Statement of Compliance Reports in Sage 100.
Resolution
- Available SOC reports (along with applicable bridge letters). [Not applicable, as Sage 100 is on-premise software where we do not conduct SOC audits].
- Audited Financials and, if applicable, bridge letter. [As a publicly-traded company, customers may review the financial information we make available on our investor webpage at https://www.sage.com/investors/financial-information/]
- Privacy Policy [Our privacy policy can be found at https://www.sage.com/en-us/legal/privacy-and-cookies/]
- Terms of Service [The end user license agreement governing a customer's purchase of Sage 100 can be found at https://www.sage.com/en-us/legal/terms/]
- Business Continuity Plan/Test Results [Not applicable to on-premise software where we do not have access to a customer's data]
- Copy of Information Security Policy [Not applicable to on-premise software where we do not have access to a customer's data]
------------------------------
Wayne Schulz
wayne@s-consult.com
Schulz Consulting
(860) 516-8990
Moodus, CT
Original Message:
Sent: 05-05-2023 12:48
From: Wayne Schulz
Subject: Sage100 and SOC report
Hmm - didn't someone ask about this within the past 12 months? I am pretty sure there was a question pretty close to this. My memory is that there was not much feedback/response.
If I'm thinking of the same thing - this might have been as close as we got ( via the Sage KB ) - Does Sage 100 support SOC auditing reports?
------------------------------
Wayne Schulz
wayne@s-consult.com
Schulz Consulting
(860) 516-8990
Moodus, CT