Why a shortlist needs a SOC 2 audit

Marquee has completed its SOC 2 Type II audit.

Worth explaining why that matters in football, because it is not really a security story.

Ask a sporting director what makes them hesitate to work with an external analytics vendor. They will interrogate the quality of the work first, and they should. But that is rarely where things stall. What stops the conversation is exposure.

A shortlist is itself information. Knowing that a club is tracking a 19 year old at a mid-table Eredivisie side, four months before anyone else moves, is a competitive asset worth more than most of the analysis around it. So is the reasoning underneath: how a club weights minutes, how it prices injury risk, which profiles it has decided it will never sign again, how it reads an opponent.

Recruitment logic, internal models, player evaluations, tactical principles. That is intellectual property, built over years, and it shapes what a club is as much as anything on the pitch. Clubs protect it the way they protect medical files, and they are right to.

So the questions we get in first conversations are consistent. Where does our data sit. Who inside your company can see it. What happens to our game logic if a rival signs with you next season.

We built for those questions before we were asked them. Each club's environment is siloed. Internal data stays inside it and does not surface anywhere else on the platform. SOC 2 Type II is independent verification that this holds in practice over time, not just in a diagram.

Marquee builds quickly. Even by our own standards this moved fast, months from decision to completed audit, which was the point. Security work that waits for a procurement team to demand it arrives too late to be useful to anyone.

Clubs are bringing more of their own thinking into Marquee than they typically hand to a vendor. That only works if the architecture earns it first.

SOC 2 compliance monitored by Scytale.