SOC 2 status

Planning window

After a compliance platform and the core policies are in operation, the working plan is a Type I point-in-time examination about four to six months later, then a Type II operating period of six to twelve months. Those dates are placeholders. Legal owns the calendar. A completed claim will be published here only when the report is in hand.

What an examiner would be able to sample today

• Row-level tenant isolation and buyer confidentiality controls.
• Append-only audit log for privileged actions.
• Security headers and secrets checks in the test suite.
• Optional Sentry error monitoring with client-side PII redaction.
• Database backup and deal-document replica procedures in the operator docs.
• Legal hold records and the nightly retention sweep.