Falcon Labs has completed its SOC 2 Type 2 examination. The examination was performed by Kesselman & Kesselman, Certified Public Accountants (Isr.), the PwC member firm in Israel, and covered the period May 1, 2026 to July 31, 2026. The report was issued on September 17, 2026.

The report addresses four of the five trust services categories: security, availability, confidentiality and privacy.

Understanding SOC 2 Type 2

SOC 2 is an attestation standard from the American Institute of Certified Public Accountants. An independent auditor examines a service organization's controls against the trust services criteria and reports on what they find.

Security is the only category the standard requires. The remaining four are selected by the organization being examined. Privacy is the least commonly included of the five. A Type 1 report assesses whether controls are suitably designed at a single point in time. A Type 2 report additionally assesses whether those controls operated effectively throughout a defined period. 

Our examination covered the full three-month window, and the auditors issued an unqualified opinion on all three matters a Type 2 report addresses: the accuracy of our description of the system, the suitability of the design of our controls, and the operating effectiveness of those controls. This was our first SOC 2 examination. 

What was examined

The report covers the Falcon Labs platform rather than a single placement or surface.

Every path a publisher could use to reach our offer network during the audit period was in scope: our integrations with post-purchase application providers, our direct server-to-server API, our Web SDK, and our mediation layer. These paths serve web and mobile environments, in checkout and in post-purchase flows.

The examination also covered the yield system that determines which offer is shown, our publisher reporting dashboards, and our managed advertiser services.

The platform runs on Amazon Web Services. As is standard for a SOC 2 of this kind, the subservice organization's own controls sit outside this report and were not evaluated by our auditors.

Falcon Labs does not process payment card data and is not part of the merchant's payment flow.

Why this matters to Falcon Labs

Our code runs inside commerce flows operated by other organizations. On an order confirmation page, it appears at the point where a brand's relationship with its customer is most visible.

That places a responsibility on us which a description of our own controls cannot discharge. An independent examination can. We included availability, confidentiality and privacy alongside security because the questions we receive are rarely limited to security alone. They concern whether the offer surface remains available, what data we retain, and how that data is handled.

"We operate on pages other organizations own, at the moment that matters most to them. I would not accept a vendor in that position who could not show me an independent audit, and it would be unreasonable to ask our clients to."

Or Shahar, Co-Founder and Chief Operating Officer, Falcon Labs

What this means for Falcon Labs clients and their customers

Clients and prospective clients can evaluate Falcon Labs against a standard their own security and procurement teams already use. Where a vendor assessment asks for a SOC 2 report, we can provide one, together with a completed security questionnaire.

For partners who integrate Falcon Labs within their own products, the report also answers the questions their customers raise about the offer network operating inside their platform.

For advertisers, the confidentiality and privacy categories address the handling of campaign and conversion data within our systems.

For the shopper who sees an offer, the examination covers how data relating to them is handled, retained and protected. That is the substance of the privacy category, and it is the reason we asked for it to be included.

Requesting the report

The report is available on request to clients, partners and organizations evaluating Falcon Labs. Write to security@falconlabs.com and we will provide it under a mutual non-disclosure agreement, ordinarily within two business days.

SOC 2 reports are restricted-use documents, which is standard. Alongside the report we can provide our subprocessor list and our data processing agreement, and we will complete your own security questionnaire if you prefer to work from it.

What comes next

We intend to repeat this examination annually and will publish each report the same way. 

Questions about this report, or about our security practices generally, can be sent to security@falconlabs.com.