When one of our customers compare NetSuite to finance platforms like Rillet, Campfire, DualEntry, or similar newcomer ERPs, the conversation often gets to security quickly. Both competitors point to SOC certifications on their websites as if it’s a check-box. These vendors present themselves as enterprise-ready. For a buyer who hasn’t been through a compliance audit, those logos and check boxes can feel equivalent. They aren’t.
A SOC report proves that controls exist and that those controls operated over a defined period. It says nothing about whether those controls covered every category, or whether exceptions were noted.
Questions to Ask Any Finance Platform Vendor
When security comes up in a competitive evaluation, these questions move the conversation from marketing logos to verifiable documentation.
Evaluating AI vendors: Due diligence questions
Plative implements your systems, connects and orchestrates your data, then layers in AI agents to provide insights and accomplish tasks alongside your people. Key due diligence questions for your security review, as a necessary step of your ERP evaluation, include:
- Can you provide the full SOC 1 and SOC 2 Type II reports, including the auditor’s opinion and any exceptions noted?
- Does the vendor maintain a formal penetration-testing program for its core ERP service, including authenticated application testing, independent security oversight, risk-rated findings, remediation requirements, and validation that material issues have been resolved?
- Did the auditor identify any testing exceptions, control deviations, complementary user-entity considerations, or modifications to the auditor’s opinion? If so, which control areas were affected?
- Do you hold ISO/IEC 42001 or another AI-management certification? If so, which legal entities, products, services, locations, and AI activities are included within its certified scope?
- For how many consecutive reporting periods has your organization obtained SOC 1 and SOC 2 Type II reports, and can you provide historical reports or applicable bridge letters?
- What is your process for remediating control failures identified during an audit period?
What a SOC Certification Proves
SOC 1 and SOC 2 certifications come from third-party auditors who examine a company’s internal controls. The existence of a SOC report means a company submitted to that review. It does not mean the review came back clean. And it does not mean the report covered every control category the standard addresses.
What a SOC Report Does and Doesn’t Confirm
✓ Confirmed by a SOC report
- Controls were defined and documented within the audit period.
- Those controls operated over the reporting period.
✗ Not confirmed by a SOC report
- All control categories passed without exception or qualification.
- The full audit artifact is available for customer review.
Buyers who request the full report sometimes find exceptions that the headline certification does not reveal.
Why the Full Report Gets Withheld
An exceptions-noted SOC report is still a “certified” report in the narrow sense. Vendors who carry exceptions have a clear incentive to keep buyers focused on the logo and away from the details. NetSuite publishes and provides complete audit artifacts across all certification categories, with no exceptions to conceal.
The Certification Comparison
Placed side by side, the differences between NetSuite and newcomer ERPs becomes concrete.
| Certification Area | NetSuite | What to Verify With Any Vendor |
|---|---|---|
| SOC 1 Type II Financial reporting controls | ✅ Full certification | Request the complete report, not a summary or logo. Confirm the reporting period is current. |
| SOC 2 Type II Security, availability, confidentiality | ✅ Full certification | Confirm which Trust Services Criteria are in scope. Security alone is not the full standard. |
| Auditor’s opinion and exceptions | ✅ Full audit artifacts provided on request | Read the opinion letter. Check for testing exceptions, control deviations, and opinion modifications. |
| Complementary user-entity controls | ✅ Documented in the report | Identify which controls the auditor pushes back onto you. These become your obligations. |
| Penetration testing program | ✅ Formal program with independent oversight | Ask for the testing scope, risk ratings, remediation requirements, and proof material findings were closed. |
| ISO/IEC 42001 AI Management System certification | ✅ Certified | Confirm the certified scope: which legal entities, products, services, locations, and AI activities. |
| Continuous reporting history | ✅ 25+ years of audit history | Count consecutive reporting periods. Request historical reports and bridge letters for any gaps. |
| Control failure remediation | ✅ Documented process | Ask how failures found mid-period are remediated and re-tested. |
ISO 42001: The First Global Standard for AI Governance
⭐ New Certification
While most vendors are still catching up on basic compliance, NetSuite has achieved ISO 42001 certification: the first internationally recognized standard specifically designed to govern AI management systems.
For organizations fielding questions about AI risk from their boards, auditors, or enterprise customers, this certification provides a concrete answer to “How do you govern AI responsibly?”
🏛️ Governance
Formal policies and accountability structures for AI development and deployment.
⚖️ Risk Management
Documented processes for identifying and managing AI-specific risks before they affect operations.
🔍 Transparency
Auditable records of AI system decisions, training data, and model behavior over time.
What Complete Certification Looks Like in Practice
Saying you have SOC certifications and being able to hand a prospect a clean, complete audit package are two different things. NetSuite can do the latter. When enterprise security and legal teams run their review processes, NetSuite provides full documentation across each of the following:
- SOC 1 Type II report, covering all financial reporting control categories, with no exceptions noted
- SOC 2 Type II report, covering security, availability, processing integrity, confidentiality, and privacy
- ISO 42001 certificate of registration for the AI Management System standard
- Full audit artifact packages available on request for customer due diligence reviews
- Penetration testing results and vulnerability management documentation for enterprise security reviews
The Practical Implication for Buyers
Any prospect that runs a security questionnaire as part of their evaluation will see this gap immediately. NetSuite can complete the questionnaire in full. Newcomer ERPs typically cannot, because their certifications carry exceptions and their audit artifacts aren’t available for review. For organizations in regulated industries or with enterprise customers of their own, this is often a disqualifying difference.
The Bottom Line
Typically, Newcomer ERPs will not answer questions 1 and 2 in full. That is the differentiator. NetSuite’s security posture is a documentation trail that holds up under enterprise-grade scrutiny at a depth that early-stage finance platforms cannot yet match.