We completed our second SOC 2 Type II audit this spring, with no exceptions. That sentence goes on our security page. This post is for the people who want to know what it actually means.

Type I and Type II

A Type I report says our controls were designed properly on a single day. A Type II report says they worked, continuously, over a period, in our case twelve months. The auditor doesn’t take our word for it. They sample real evidence across the year: access reviews, change approvals, incident tickets, backup tests.

What was tested

SOC 2 is organized around trust principles. Ours covered security, availability and confidentiality. In practice, the auditor tested things like:

• Access. Whether staff access to production is approved, reviewed every quarter and removed promptly when someone leaves. They sampled leavers and checked the timestamps.

• Change management. Whether every change to production is reviewed by a second engineer and tested before release, including changes to models and agent instructions.

• Encryption. Whether customer data is encrypted at rest and in transit, everywhere it’s stored.

• Monitoring and incidents. Whether alerts are raised, investigated and closed, and whether incidents follow our written response plan.

• Backups. Whether backups run daily and restores are actually tested. Ours are tested every quarter.

• Vendors. Whether we review the security of our own sub-processors.

What’s specific to agents

Agents raise questions a standard SOC 2 scope doesn’t fully answer, so we asked our auditor to include three areas: that guardrails are enforced outside the model, that agent permissions in customer systems follow least privilege, and that the Run Log can’t be edited after the fact. All three are in the report.

What SOC 2 doesn’t tell you

A clean report doesn’t mean a vendor can’t be breached, and it doesn’t cover how your own team configures the product. It also doesn’t say anything about model quality. We cover those separately: an annual penetration test by an independent firm, our ISO 27001 certification, and the adversarial testing we run before every model or instruction change.

How to get the report

Our full SOC 2 Type II report, ISO 27001 certificate and penetration test summary are in our security pack, which we send under NDA within one business day. If your team has a questionnaire, send it with your request. Most of the answers are already in the pack, and I’m happy to take the rest on a call.

Security reviews are slow when vendors make reviewers dig. We would rather show our work.