We help other companies achieve SOC 2 attestation. We hold ourselves to the same standard.
soc2audit.ai is built and operated by Cybersecurity Services, LLC (Cyber Security Services), a CISSP-led cybersecurity firm founded in 2014 with a decade of experience delivering enterprise security programs, penetration tests, and SOC 2 engagements for Fortune 500 clients and high-growth startups.
We designed soc2audit.ai the way we’d want a compliance platform designed to hold our own customers’ data: encrypted in transit and at rest, isolated per customer, minimally privileged, monitored, and reviewed against the same AICPA Trust Services Criteria our customers are audited against.
SOC 2 Type II: annual report
AES-256 at rest · TLS 1.2+ in transit
Hosted on Microsoft Azure
CISSP-led
soc2audit.ai runs on Microsoft Azure. Azure holds ISO 27001, SOC 1, SOC 2, SOC 3, FedRAMP High, HIPAA, and other certifications. See the Azure Trust Center for current attestations.
● HTTPS enforced with TLS 1.2 or higher
● Azure platform DDoS protection
● Rate limiting on sign-in and other sensitive endpoints
● The database accepts connections only from Azure services, with credentials
● Source code in a private repository with automated build and deployment
● Application secrets kept in protected Azure configuration, not in source code
● Dependency updates with expedited patching for critical vulnerabilities
● Separate development and production environments
● Full security review of tenant isolation, authentication, input handling, and front-end code (July 2026)
● Findings fixed and verified before release
● Ongoing review of dependencies for known vulnerabilities
Production changes are deployed through an automated pipeline from version control, with health checks after each release and the ability to roll back to the previous version.
All employees and contractors with access to production systems undergo background checks appropriate to their role and jurisdiction.
All employees sign confidentiality agreements as a condition of employment.
● Onboarding security training within 30 days of hire
● Annual security awareness refresh
● Role-specific training for engineers (secure coding) and support staff (data handling)
● Phishing simulation exercises
Employee devices accessing production systems are managed via mobile device management (MDM), full-disk encrypted, and monitored by endpoint detection and response (EDR).
SOC 2 Type II report available once a year, under NDA on request.
Security, Availability, Processing Integrity, Confidentiality, and Privacy mapping maintained internally.
We support customer GDPR obligations as a data processor. contact us about a data processing agreement.
We honor California privacy rights as described in our Privacy Policy.
BAA available for customers in the healthcare sector on request.
If a framework you need isn't listed, contact us. We may be able to accommodate it under a specific engagement.
We use a small number of subprocessors to deliver the Service: Microsoft Azure (hosting, database, file storage, and email delivery) and Anthropic (AI processing). Each is contractually required to protect customer data.
We provide notice of material subprocessor changes.
Please do not test against production customer data or attempt denial-of-service testing.
Related questions or documentation requests (SOC 2 report, penetration test summary, security questionnaire), contact
For a summary of our security program and to request documentation, visit our Trust Center.
