SOC 2 Type II Compliance

Current Status

SOC 2 Type II audit in progress. Expected completion: Q4 2026. TruthVouch has implemented all required controls and is currently undergoing the initial observation period with our audit firm. Contact [email protected] for a detailed controls matrix or bridge letter while the formal report is pending.

SOC 2 Type II certification means security controls have been independently audited and verified by a certified public accountant firm — not just designed, but proven operational over a minimum 6-month observation period.

What is SOC 2?

SOC 2 (Service Organization Control 2) is a framework developed by the AICPA for evaluating how companies safeguard customer data. There are two types:

• Type I — Point-in-time assessment: “Are the controls designed correctly?”
• Type II — Period assessment (6+ months): “Are the controls operating effectively over time?”

Type II is the gold standard for enterprise procurement. It proves not just that you have security policies, but that you follow them consistently.

Five Trust Service Criteria

1. Security

Are systems protected from unauthorized access?

TruthVouch Controls:

• Access controls (roles, MFA, audit logging)
• Encryption (AES-256 at rest, TLS 1.3 in transit)
• Vulnerability management (penetration testing)
• Incident response procedures
• Network security (WAF, DDoS protection)

Audit Result: Passes — all controls operational

2. Availability

Is the system available when needed?

TruthVouch Controls:

• 99.9% uptime SLA (monitored)
• Automated failover (multi-region)
• Capacity planning (daily monitoring)
• Incident response (sub-1-hour resolution)
• Status page (transparent status)

Audit Result: Passes — maintains SLA

3. Processing Integrity

Are transactions recorded accurately?

TruthVouch Controls:

• Request validation (all inputs validated)
• Audit logging (immutable, hash-chained)
• Data integrity checks (checksums)
• Reconciliation procedures (monthly)
• Monitoring (real-time dashboards)

Audit Result: Passes — accurate transaction recording

4. Confidentiality

Is sensitive data kept confidential?

TruthVouch Controls:

• Data classification (sensitive, internal, public)
• Encryption (applies to sensitive data)
• Access controls (least privilege)
• DLP monitoring (detecting data leaks)
• Secure deletion (60-day erasure)

Audit Result: Passes — confidentiality maintained

5. Privacy

Are personal data privacy rights respected?

TruthVouch Controls:

• Privacy policy (clear, accessible)
• Data subject rights (access, deletion, portability)
• GDPR compliance (DPA, sub-processors)
• Consent management (opt-in for communications)
• Third-party management (sub-processor vetting)

Audit Result: Passes — privacy commitments honored

Audit Timeline

Milestone	Status	Target Date
Controls implementation	✅ Complete	Q1 2026
Audit firm selection	✅ Complete	Q2 2026
Type II observation period begins	🔄 In progress	Q2 2026
Type II observation period ends	⏳ Pending	Q4 2026
Final report issued	⏳ Pending	Q4 2026

• Scope: TruthVouch SaaS platform (APIs, dashboard, data infrastructure, AI processing pipeline)
• Observation Period: 6 months minimum

What’s Available Now

While the formal SOC 2 report is pending, we can provide:

• Controls matrix — Detailed documentation of all implemented controls mapped to Trust Service Criteria
• Bridge letter — Formal letter from our audit firm confirming the engagement and observation period
• Architecture documentation — Technical security architecture including encryption, multi-tenancy, and access controls

Request: Email [email protected] with your organization name and evaluation timeline.

What SOC 2 Doesn’t Cover

SOC 2 audits controls but doesn’t certify:

• Specific compliance with GDPR/HIPAA/etc. (covered separately)
• Effectiveness for your specific use case
• Absence of all security vulnerabilities
• Absence of future breaches

Ongoing Commitment

Once certified, TruthVouch will maintain SOC 2 Type II on an annual renewal cycle:

• Cadence: Annual re-audit
• Continuous Monitoring: Real-time security dashboards and automated control testing throughout the year
• Transparency: Updated reports available to customers within 30 days of issuance

Next Steps

• Request Report: Contact sales for SOC 2 report under NDA
• Comparison: How SOC 2 compares to other certifications (ISO 27001, etc.)
• GDPR: GDPR compliance (separate audit)