Sage 100

 View Only
  • 1.  Sage100 and SOC report

    Posted 05-05-2023 12:06

    Hi - I found a 10 year old thread on this, where the links are not around anymore.

    Has anyone dealt with a customer request regarding SOC and Sage100 recently ?

    Thank you

    Jeff Fiddelman



    ------------------------------
    Jeff Fiddelman
    Exeplex, LLC
    ------------------------------


  • 2.  RE: Sage100 and SOC report

    Posted 05-05-2023 12:48

    Hmm - didn't someone ask about this within the past 12 months? I am pretty sure there was a question pretty close to this. My memory is that there was not much feedback/response.

    If I'm thinking of the same thing - this might have been as close as we got ( via the Sage KB ) - Does Sage 100 support SOC auditing reports?



    ------------------------------
    Wayne Schulz
    wayne@s-consult.com
    Schulz Consulting
    (860) 516-8990
    Moodus, CT
    ------------------------------



  • 3.  RE: Sage100 and SOC report

    Posted 05-05-2023 12:49

    Does Sage 100 support SOC auditing reports?

    Created on 06-14-2022 / Last modified on 03-09-2023

    Summary

    Does Sage 100 support SOC auditing reports?

    Does Sage uses SOC 2 Bridge Reports?

    Statement of Compliance Reports in Sage 100.

    Resolution

    1. Available SOC reports (along with applicable bridge letters).  [Not applicable, as Sage 100 is on-premise software where we do not conduct SOC audits].
    2. Audited Financials and, if applicable, bridge letter.  [As a publicly-traded company, customers may review the financial information we make available on our investor webpage at https://www.sage.com/investors/financial-information/]
    1. Privacy Policy [Our privacy policy can be found at https://www.sage.com/en-us/legal/privacy-and-cookies/]
    2. Terms of Service [The end user license agreement governing a customer's purchase of Sage 100 can be found at https://www.sage.com/en-us/legal/terms/]
    3. Business Continuity Plan/Test Results [Not applicable to on-premise software where we do not have access to a customer's data]
    4. Copy of Information Security Policy [Not applicable to on-premise software where we do not have access to a customer's data]


    ------------------------------
    Wayne Schulz
    wayne@s-consult.com
    Schulz Consulting
    (860) 516-8990
    Moodus, CT
    ------------------------------



  • 4.  RE: Sage100 and SOC report

    Posted 12-13-2024 12:07
    Edited by Brett Zimmerman 12-13-2024 12:14

    Is this still n/a for Sage 100, even when it's being hosted in the cloud?

    Btw, it appears that article above no longer exists in the kb, although I just located this one:

    Does Statement of Auditing Standards SSAE 16 or SOC certification apply to Sage products?

    Created on  | Last modified on 

    Summary

    Does Sage provide an SOC 1 (System and Organization Controls) report?

    Resolution

    Because Sage Products are provided as packaged software solutions rather than as services, SSAE 16, SSAE 17, and SOC 1 (formerly SAS 70) certification doesn’t apply.

    The Statement on Auditing Standards SSAE 16, SSAE 18, SOC 1, and the previous SAS 70, Service Organizations, is an auditing standard that was issued by the American Institute of Certified Public Accountants (AICPA). The intent of the standard is to provide a guideline to ensure that adequate controls are in place over service organizations and service providers.

    SSAE 16, SSAE 18, SOC, SOC 1 and SAS 70 applies when financial statements are audited only if the organization obtains services from another organization. Sage Accounting and specialized solutions (such as Sage X3 ERP, Sage 100 ERP, Sage 50, Sage 500 ERP, Sage Fixed Assets, Sage 300, Sage Pro, and Sage Business Vision) are provided as packaged software solutions rather than as services.

    Organizations that use Sage Accounting solutions are always in full control of their data - from establishing access, entering information, and producing reports. While organizations may provide data or reports to Sage for specific projects (for example, Sage Expert Services engagements), no data is ever automatically sent outside of the organization's control. Under no circumstance is Sage represented as a service provider for retrieving, analyzing, and reporting on any organization's information.

    **SSAE 16 and SSAE 18 effectively replaced SAS 70 as the standard for reporting on service organizations**

    Link to further informationhttps://www.ssae-16.com/soc-1/



    ------------------------------
    Brett Zimmerman
    Net at Work
    Greater Boston Area
    ------------------------------



  • 5.  RE: Sage100 and SOC report

    Posted 12-13-2024 12:18

    Sage has a caveat with the Sage Endorsed Cloud Partners who host Sage 100, that they would achieve a SOC certification in order to be endorsed by Sage.  And it was one of the qualifications for us to be a Sage Hosted Provider in the first place.  I don't know how many other Endorsed Hosting Providers have actually gone through the process for getting that SOC Certification (I kinda doubt everyone did that and I'm not sure Sage is following up on everyone either), but we just finished our SOC2 Cert and it took almost a year.  But – for anyone who hosts with us, we can provide evidence of the SOC2 cert now.

     

    Sue Bennett/President

    P. 503.620.3484 / E. sue@benpor.com

     

    Bennett/Porter & Associates, Inc.
    12559 SW 69th Ave / Tigard, OR 97223
    benpor.com / facebook / instagram

     

     

    A black background with a black square  Description automatically generated with medium confidence

     

    The information in this email and any attachments is considered confidential. This information may be subject to legal, professional, or other privilege. It must not be disclosed to any person without our authority. If you are not the intended recipient you are not authorized to and must not disclose, copy, distribute, or retain this message or any part of it. Please return this message to the sender immediately and delete any and all copies from your system.

     

     






  • 6.  RE: Sage100 and SOC report

    Posted 12-13-2024 12:28

    Yes, the Sage-endorsed Cloud/hosting partner has already provided the SOC Report and Bridge Letter, but now the client is asking re: Sage 100.  But maybe that just also covers Sage 100?



    ------------------------------
    Brett Zimmerman
    Net at Work
    Greater Boston Area
    ------------------------------



  • 7.  RE: Sage100 and SOC report

    Posted 12-13-2024 12:31

    Brett – I could be wrong, but my assumption is that it does apply to Sage 100...

     

     

    Sue Bennett/President

    P. 503.620.3484 / E. sue@benpor.com

     

    Bennett/Porter & Associates, Inc.
    12559 SW 69th Ave / Tigard, OR 97223
    benpor.com / facebook / instagram

     

     

    A black background with a black square  Description automatically generated with medium confidence

     

    The information in this email and any attachments is considered confidential. This information may be subject to legal, professional, or other privilege. It must not be disclosed to any person without our authority. If you are not the intended recipient you are not authorized to and must not disclose, copy, distribute, or retain this message or any part of it. Please return this message to the sender immediately and delete any and all copies from your system.

     

     






  • 8.  RE: Sage100 and SOC report

    Posted 12-14-2024 00:40

    The SOC2 report has controls generally related to the IT infrastructure surrounding anything that is hosted (along with other items), regardless of the actual product. To that end, I presume Sage 100 would be covered. 

    We have been SOC2 certified for the past three years, and typically, any requests regarding audit requirements are fully satisfied when we provide the SOC2 report. We've never dealt with additional pushback.

    We sometimes get asked for a SOC1, but that does not apply to hosting providers.



    ------------------------------
    George Khairallah
    CTO / Co-Founder | gotomyerp / Zaptiva / CFOTech
    george.k@gotomyerp.com | 877-888-5525
    https://gotomyerp.com
    ------------------------------



  • 9.  RE: Sage100 and SOC report

    Posted 12-15-2024 11:46
    Edited by Wayne Schulz 12-15-2024 11:48

    This is a good topic for our content library since some of Sage's original KB around this appears to have disappeared ( or is difficult to find ). I've also added a brief summary of what SOC 1 v SOC 2 are - Does Statement of Auditing Standards SSAE 16 or SOC certification apply to Sage products?

    If needed, please use this link to request access to the 90 Minds Content Library on Google - https://docs.google.com/forms/d/e/1FAIpQLSeWlPDlG3xZHjWvQdUuzokcMbjDM-hhyXm_KSi3YLPZ9bk7tg/viewform



    ------------------------------
    Wayne Schulz
    wayne@s-consult.com
    Schulz Consulting
    (860) 516-8990
    CT
    ------------------------------