SOC 2 Status

Status: Phase 30 G4.T4 deliverable — SOC 2 program status pane + NDA-gated letter workflow. Source SoT: docs/compliance/soc-2-type-ii-report-status.md (the engineering-side SoT — this Trust Center page mirrors the §4 mapping verbatim). Cardinal rule: No overclaim. This page MUST NOT publish "SOC 2 certified", "SOC 2 compliant", "SOC 2 audited", or any equivalent claim before the auditor opinion letter is received + the CEO signs off.

Current Status

| Compliance program | Current status | |---|---| | SOC 2 Type II | Not yet achieved — Type II observation period not yet started |

This pane defers to docs/compliance/soc-2-type-ii-report-status.md §4 — the engineering SoT. The display string above is the verbatim mirror.

Program Timeline

The SOC 2 Type II program is a multi-stage long-running effort:

1. Engineering buildout (Phase 30) — control framework + evidence collection automation surface + gap remediation tracker + Trust Center scaffold + internal runbook. STATUS: in progress (Phase 30 execution).
2. Auditor procurement — Vanta-managed or Big 4 sub-firm direct. STATUS: PENDING.
3. Engagement letter signing — auditor + Claimful CEO + Legal. STATUS: PENDING.
4. Evidence portal credential drop — Claimful CTO. STATUS: PENDING.
5. Gap remediation (High + Medium) — Claimful engineering. STATUS: GREEN (zero open High/Medium gaps — see docs/compliance/soc-2-gap-analysis.md).
6. Type II observation period (12 months) — auditor monitors operating effectiveness. STATUS: PENDING.
7. Auditor fieldwork (~6-8 weeks) — auditor reviews observation evidence + conducts walkthroughs. STATUS: PENDING.
8. Opinion letter delivery — auditor delivers signed opinion letter. STATUS: PENDING.
9. CEO sign-off — CEO acknowledges opinion letter. STATUS: PENDING.
10. Type II achieved — report_status flips from PENDING to ACHIEVED on the engineering SoT. STATUS: PENDING.
11. NDA-gated letter workflow activated — see §"NDA-gated letter request workflow" below. STATUS: PENDING.

NDA-gated letter request workflow

When the Type II report achieves (step 10 above), the SOC 2 letter becomes available to customers under NDA. The workflow is:

1. Request initiation — customer emails compliance@claimful.ai with company name + use case.
2. NDA delivery — Claimful Legal sends the standard mutual NDA via Docusign within 2 business days.
3. NDA execution — customer signs the NDA.
4. Letter delivery — Claimful delivers the SOC 2 letter via Docusign-protected link within 1 business day of NDA execution.
5. Audit trail — every letter delivery logged in audit_log with the recipient company + NDA reference + delivery timestamp.

Activation prerequisites: Type II report ACHIEVED status on docs/compliance/soc-2-type-ii-report-status.md + auditor approval of public-facing language for the letter cover.

Current state: workflow scaffold ready; activation gated on Type II achievement.

Future Updates

Status changes to the SOC 2 program flow through the engineering SoT (docs/compliance/soc-2-type-ii-report-status.md) and mirror to this page within 1 business day. The Trust Center is the public-facing read-only view; the SoT is the authoritative mutator.

Source SoT cross-reference

For the engineering-side detail on observation period progress, opinion type, and renewal cadence, see docs/compliance/soc-2-type-ii-report-status.md §§ 3, 5, 7. This page exists to mirror the customer-facing status string — it does NOT carry the full engagement record (that lives in docs/compliance/soc-2-auditor-engagement.md internal SoT, customer-confidential).