SOC 2 Type II readiness

What SOC 2 is

SOC 2 is an independent audit, run by a licensed CPA firm, of how a company protects customer data. A Type II report tests that controls actually worked over an observation period (usually 3–12 months). It is the report most US companies ask for before buying security software.

Planned scope

• Trust criteria: Security (required), Availability and Confidentiality.
• Systems: the encased.ai website and console, the agent gateway API, the database, the SDKs and the self-hosted gateway build.

Controls already in place

• Encryption in transit (TLS) and at rest.
• Agent keys stored as one-way hashes, shown once, instantly revocable.
• Per-workspace data separation enforced in the database.
• Role-based access (owner, admin, analyst, viewer) for every workspace.
• Tamper-resistant audit log of containment actions and policy changes.
• Personal data masked before reviewers see it.

Steps remaining

• Written security policies (access control, change management, incident response, vendor management, business continuity).
• Compliance automation platform to collect evidence continuously.
• Independent penetration test.
• Type I report (point-in-time), then a Type II observation period.

Target timeline

Estimated: Type I within about 6 months of starting, Type II about 6–12 months after that. These are estimates, not commitments.