Unauthorized access can expose your startup's financial data. Puzzle is an AI-native accounting firm: AI-native accounting software plus accountants who review and finalize the books. We use Google Cloud (GCP), Google Workspace, Vanta for automated compliance monitoring, and hardware authentication to help protect access. We're SOC2 compliant and committed to protecting your data. Our real-time trust dashboard provides security information.
TLDR:
Puzzle's audit log records who created or modified each transaction, so you can trace changes to your startup's books. You can also export financial reports as PDFs or individual reports to Excel, giving you copies to keep or share outside Puzzle.
Protecting your startup's financial data takes multiple layers of security. For cloud-based operations, Google documents default encryption at rest for stored customer content. Encryption helps protect stored data; it does not prevent every form of unauthorized access. Puzzle's published controls also cover restricted production database access and unique account authentication.
We use Vanta for automated compliance monitoring. Vanta advertises 1,400+ automated hourly tests and 400+ integrations across its product. Those totals do not confirm how many tests or integrations Puzzle uses. Monitoring can flag control gaps for review; it does not guarantee that every issue will be fixed before harm occurs. For cybersecurity startups, the relevant evidence is the scope of the vendor's audit and the controls it covers.
For founders reviewing vendors in October 2026, dated evidence is more useful than headline percentages. The FBI's December 2024 fraud alert warns that criminals use generative AI to make spear-phishing messages more believable and reduce grammatical or spelling errors. Audit scope varies. CBIZ's 2024 benchmark study found confidentiality in 64.4% of 73 sampled SOC 2 reports, compared with 34% of 38 reports in its 2023 sample. These are separate annual samples, not a 2026 market-wide rate or a new SOC 2 requirement. For your startup's financial data, check the vendor's audit period, scope, and access controls instead of treating compliance as a guarantee against breaches.
A vendor saying it uses multi-factor authentication (MFA) leaves an important question unanswered: can that method resist phishing? NIST's digital identity guidelines, finalized in July 2025, give founders a useful benchmark for October 2026 vendor reviews. Under NIST's authentication requirements, services meeting Authentication Assurance Level 2 must offer a phishing-resistant option.
For your startup's AI bookkeeping software, ask which login methods protect access to financial data, whether phishing-resistant authentication is required for privileged accounts, and how account recovery works if a security key is lost. These guidelines are a technical benchmark, not a new SOC 2 requirement or proof that Puzzle meets a particular NIST assurance level. Use them alongside the vendor's audit scope to ask better questions about access to your books.
Yes. Puzzle is SOC 2 compliant. Its trust center resources list a SOC2 2025 Audit Report available through an access request. The report's audit period and scope matter when reviewing the evidence; automated monitoring does not replace an independent audit.
Puzzle uses Google Cloud (GCP) and Google Workspace. Google documents default encryption at rest for stored customer content. Puzzle's published security controls include restricted encryption-key access, restricted production database access, and unique account authentication.
Puzzle uses hardware authentication to help protect access. NIST's 2025 authentication guidelines describe WebAuthn, used by FIDO2 authenticators, as a standard that provides phishing resistance by binding authentication to the legitimate service's domain. This general guidance does not confirm Puzzle's specific hardware configuration. The protection depends on the authentication method and its configuration; a hardware key is not a guarantee against every account compromise.
SOC 2 reports help your startup review a vendor's controls, but the scope matters. CBIZ's 2024 benchmark study found differences in the categories covered by sampled reports. Review the audit period and included systems against your buyer's requirements. Puzzle's SOC 2 compliance is evidence for that review, not a guarantee that every procurement requirement is met.
Puzzle's trust center publishes control information and lists audit resources. The resource list includes a SOC2 2025 Audit Report and Penetration Testing Attestation 2025. Access to those documents requires a request; the public control summaries are not a substitute for the audit report.
| Security Layer | Technology Used | What It Protects Against |
|---|---|---|
| Cloud Infrastructure | Google Cloud (GCP) | Helps protect stored customer content through default encryption at rest |
| Workspace & Access Controls | Google Workspace | Access control enforcement, collaboration security |
| Automated Compliance | Vanta automated compliance monitoring | Flags control gaps for review and collects audit evidence; does not replace an independent SOC 2 audit |
| Hardware Authentication | Hardware authentication keys | Can reduce unauthorized login risk; phishing resistance depends on the method and configuration |
Phishing scams and credential leaks are a real threat, and we've taken proactive measures to keep your data safe.
Our hardware authentication keys help protect against unauthorized access.
At Puzzle, we are deeply committed to defending our customers' data. Google Cloud (GCP), Google Workspace, and Vanta are part of our security and compliance processes. Using these tools does not replace an independent SOC 2 audit.
Book a demo to discuss Puzzle's accounting software and services for your startup.
