SOC 2 status and roadmap

Apptonomy does not currently have a SOC 2 report, and no SOC 2 examination is currently underway.

The controls described on this page are our own practices. No independent auditor has examined them.

• An internal gap analysis against all five Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy — completed on 22 September 2026, with a remediation roadmap for its findings.
• An Information Security Policy and sixteen annexes, approved on 22 September 2026, each with an owner and an annual review date.
• Recurring controls with dated records, each first performed in September 2026: a control self-assessment, a quarterly access review, a backup restore test, an incident-response drill, an edge-rule review, and sanctions screening of our vendors.
• Automated checks that report when a policy passes its review date or a recurring control has no current dated record.
• Blocking dependency-vulnerability, secret and static-analysis scans on every code pull request, and monthly perimeter and cloud-configuration scans.

1. 1Finish verifying environment isolation: staging now has its own customer database, identity and keys; the local, preview and sandbox paths still need the same proof.
2. 2Commission an independent penetration test of the web application and API, planned for Q1 2027.
3. 3Build operating history: run the recurring controls on their schedules and keep the dated records an auditor samples.
4. 4Engage an independent auditor for a SOC 2 examination.