Compliance — SOC 2 & ISO 27001

No audit has been performed against either framework, so there is no report to share and no bridge letter. We are not in an observation window, and we will not describe ourselves as "SOC 2 aligned", "pursuing SOC 2", or any of the other phrasings that sound like an audit without being one. What does exist is a documented description of the controls actually implemented, on the security page, written to be checked rather than admired. It is self-reported. That is a weaker thing than an audit and we are not going to present it as an equivalent one.