SOC 2
We are not SOC 2 audited yet.
Our Type I target scope is Security and Confidentiality, and no auditor is engaged yet. Here is what that means, what already exists, and what Secure Raven can and cannot do for your own SOC 2 work.
- Security
CC1–CC9In target scope - Confidentiality
C1In target scope - Availability
A1Later - Processing IntegrityNot selected
- PrivacyNot selected
- CPA firm
- Not engaged
- Type I report
- None
- Type II report
- None
- Type I
- Not audited.
- Type II
- Not audited.
- Target scope
- Security (CC1–CC9) and Confidentiality (C1).
- Auditor
- None engaged yet.
SOC 2 in brief
What a SOC 2 report is.
Three facts that decide what anyone, us included, can honestly say about SOC 2.
- Attestation
An opinion, not a certificate
A SOC 2 report is an independent CPA firm’s opinion on a company’s controls, measured against the AICPA Trust Services Criteria. Only a CPA firm can issue one.
- Type I · Type II
A point in time, or a period
Type I looks at whether controls are suitably designed at a point in time. Type II also tests whether they operated effectively over a review period, often six to twelve months.
- Scope
Security, plus what you choose
Security, the common criteria, is always in scope. Availability, Processing Integrity, Confidentiality and Privacy are chosen for each report.
Where we stand
Not audited, and no auditor yet.
Our own SOC 2 status, line by line. The audit fields come from the public trust manifest.
- Independently audited
- No Not for Type I, not for Type II.
- CPA firm
- Not yet No auditor is engaged.
- Type I target scope
- Security (CC1–CC9) and Confidentiality (C1).
- Availability (A1)
- Later.
- Not selected
- Processing Integrity and Privacy.
In the trust manifest
live · machine-readableGET /api/trust/manifest
"soc2": {
"independentlyAudited": false,
"reportType": null
}A control map exists. Secure Raven is not independently audited for SOC 2 Type I or Type II.
What already exists
Controls in place today.
Existing controls are not an audit: only a CPA firm can say whether they are suitably designed. Every control, with the value it runs at
- Row-level security on every tenant table, with cross-tenant isolation tests.
- Closed-by-default database privileges: the public anon key can run and read nothing.
- MFA with a 5-minute step-up before privileged actions, and recovery codes stored as keyed hashes.
- Ed25519-signed probe and API requests. We store only public keys.
- An append-only, hash-chained audit log that we do not delete.
- Encryption in transit (TLS 1.2 or later) and at rest (AES-256).
- Written policies for access control, change management, data classification, retention, incident response and vulnerability disclosure.
Not done yet
- An engagement with a CPA firm.
- An external penetration test. The scope is written; no test has been commissioned.
For your SOC 2
Evidence for your auditor. Not the audit.
What Secure Raven gives a team preparing for its own SOC 2, and what it cannot do. In private early access, the three Web Ravens run in production today.
What it gives you
- Technical evidence from the systems you connect: findings ranked Critical, High, Medium or Low, and the scan history behind them.
- A sanitized evidence pack you can export.
- An append-only, hash-chained record of privileged actions in Secure Raven, with an export of the chain’s head hash and counts.
- A control catalog that includes five SOC 2 common criteria: CC6.1, CC6.2, CC7.1, CC7.2 and CC8.1. Findings are not linked to them automatically yet.
- Watch: a scheduled safe inspection of a source, every 6 hours by default.
What it cannot do
- Produce a SOC 2 report, or stand in for your auditor.
- Show that a control operated over a period. Watch runs on a schedule; it is not 24/7 monitoring.
- Cover your whole company. It checks only the systems you connect.
Evidence for your auditor, from your own systems.
Secure Raven is in private early access. Tell us what you run.