SOC 2 Type II - Final Review

Ha, same. Okay so, uh, really the reason I pulled everyone together today is we need to do a final walk-through of the SOC 2 Type II materials before we hand them off to the auditors, and honestly I'm — I'm feeling pretty good about where we landed.

Yeah, I was looking at the Comply v2 exports this morning and I have to say, like, the on-demand reporting is just — it's night and day compared to what we were doing manually before.

Right? I remember we used to spend like two weeks pulling evidence packages together and now it's just... click, done.

So, the big sections are — availability controls, change management, logical access, and then incident response. And I want to walk through each one but I also, um, I want to flag the incident response section specifically because of the March outage.

Yeah, I was going to ask about that. How are we — how are we framing the Detect outage in the documentation?

So that's actually something Tyler and I worked through last week, and I think we landed in a really good place — like, we're being fully transparent about the six hours of monitoring visibility loss, but we're also showing the complete remediation arc. Redundant nodes, the circuit breaker implementation, post-incident review docs, all of it.

Yeah and honestly, from a controls narrative standpoint, auditors typically respond well when you can show a clear before-and-after. Like here's the gap, here's what we did, here's the evidence that it's fixed. That's a mature posture.

I completely agree with that framing. And Diana, from a customer-facing perspective, if this comes up in any account conversations, that's exactly the story — we identified a single point of failure, we fixed it comprehensively, and we have the audit trail to prove it.

Good, yeah. I'll be honest, I was a little nervous about how the auditors would receive that section but hearing you frame it that way, Tyler, that makes me feel a lot better.

Yeah, I think we're in good shape. Okay, so let me jump to the logical access section — this is where Aegis Identity really shines in our own dogfooding. We've got full MFA enforcement documented, SSO logs going back the full audit window, access review records quarterly.

Oh, and the deprovisioning logs — I want to make sure those are in there. That was a gap finding from our last Type I.

Yep, already in there. I specifically made sure of that. You can see it — section 4.3, employee offboarding workflow with timestamps.

Oh nice, okay. Yeah that's — that's going to close out that finding cleanly.

Can I ask a quick question about the Comply v2 export format? Because I want to understand — when the auditor pulls this, is it like a static PDF or is it a live link?

So it's — great question. The export is a point-in-time PDF with a hash for verification, but you can also generate a new one on demand if they want a refreshed snapshot. So it's not like a stale document sitting there.

Oh that's actually really elegant. Because the last audit we did, the auditor kept coming back with 'oh can I get an updated version of this' and it was just — it was painful.

Ha, yes — that's exactly the problem Comply v2 was designed to solve. Like, that pain point is the whole origin story of that feature.

Okay, I want to flag one thing on availability — and this is minor, but I want to make sure we address it before submission. The uptime SLA documentation references 99.9% availability, but during the March window we were technically below that for Detect. Are we annotating that?

Yeah, so — I'm glad you brought that up. We have a separate exception note with the incident report attached. Auditors expect exceptions to be documented, not hidden. And we actually came in above 99.9 for the full audit period across all other services, so the overall availability story is still very strong.

Got it, okay. I just wanted to make sure it wasn't buried. As long as it's clearly cross-referenced I'm happy.

It is, yeah. I'll send you the specific page reference after this call so you can verify.

So the plan is to get Nina's final QA sign-off by Wednesday, I'll do one last pass on the evidence package Thursday morning, and then we submit Thursday afternoon. Auditors have us in their queue for the week of April 27th.

Wednesday is tight for me but doable. I just need to make sure I have access to the final Comply export — Tyler, can you make sure I'm provisioned on the reporting module?

Yes, actually — we have three enterprise prospects who've asked for SOC 2 Type II as a procurement requirement, and two existing customers who have it in their renewal terms. So getting the report by end of May is pretty critical for us commercially.

Okay, that's helpful context. I don't think we're at risk on that timeline at all — if we submit Thursday and the audit window is the week of the 27th, we should have the report well before end of May.

That's a relief. I'll let those accounts know we're on track. Honestly, this whole process has been so much smoother than I expected — like, last year's audit was just a nightmare in comparison.

Aw, thanks Nina. Okay, I think we've covered everything — let me just recap the actions real quick: Nina signs off by Wednesday, I finalize Thursday morning, Tyler you're on standby for any last-minute evidence questions, and Diana you'll hold comms with the auditor contact. Everyone good?

Good with me.

Yep, sounds great. Excited to get this across the finish line.

Same. Thanks everyone, this was a great call.