SOC 2 status
No SOC 2 report is held, and no audit has been engaged yet. This page explains what a SOC 2 Type II audit involves and lists, criterion by criterion, which controls exist today and which do not, so you can assess them directly.
Current status
Neither Type I nor Type II
No CPA firm has been engaged
No controls are under audit observation
What SOC 2 is
SOC 2 (System and Organization Controls 2) is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA). An independent CPA firm examines a service provider's controls against the Trust Service Criteria and issues a report. It is a report, not a certification. A Type II report covers how controls operated over an observation period, commonly 3 to 12 months.
SOC 2 Type I vs Type II
Type I
Evaluates the design of controls at a specific point in time.
- •Point-in-time assessment
- •Tests whether controls are suitably designed
- •No observation period
Type II
Evaluates how effectively controls operate over an observation period.
- •Observation period, commonly 3 to 12 months
- •Tests whether controls operated consistently
- •The report most enterprise security reviews ask for
Controls today, by Trust Service Criterion
These are the three criteria most relevant to a healthcare revenue cycle platform. Nothing here has been examined by an auditor; each line states what exists today.
Security
Protection of system resources against unauthorized access
- In place. Authentication: password or Google sign-in, TOTP MFA enforced for administrators (and for all users where the organisation requires it), account lockout
- In place. Logical access: server-side role-based access control and tenant isolation enforced by database row-level security
- Not yet in place. Physical access controls for the hosting site: not documented
- In place. Transmission security: TLS 1.2 or later at the edge, HSTS, origin reached through an encrypted tunnel
- Partial. Change management: releases go through scripted build and promotion steps; no written change-management policy
- Partial. Risk assessment: a first risk analysis was drafted on 2026-10-01 and has not been adopted
- Not yet in place. Intrusion detection: none in place
- Not yet in place. Breach response: a breach-response procedure has been drafted and not adopted
Availability
System is available for operation and use as committed or agreed
- Not yet in place. Availability commitment: no availability SLA is offered
- Partial. Backups: daily database dump with 14-day retention, unencrypted, stored on the same disk as production; no redundant copy
- Partial. Disaster recovery and business continuity: a contingency plan for the current deployment has been drafted and not adopted; one restore from backup rehearsed into a test database (2026-10-01), none scheduled
- Partial. Incident response: a runbook exists for service outages, and outages can be published on the public status page; the procedure for incidents involving PHI is a draft
- Partial. Availability checks: each component's health is recorded about once a minute and published on the status page; nothing alerts a person, and there is no anomaly detection
Confidentiality
Information designated as confidential is protected as committed or agreed
- Partial. Data classification: each PHI field is classified in code as encrypted or left in clear with a recorded reason; no written data-handling policy
- Partial. Encryption: TLS in transit and AES-256-GCM on designated PHI fields; the database volume and backups are not encrypted
- Not yet in place. Confidentiality agreements with personnel: not documented
- Not yet in place. Secure disposal of media: no written standard
- In place. Access restrictions: role-based access control, tenant isolation, and separate logging of PHI access on every screen that opens a patient's record
What a SOC 2 Type II audit involves
A general explanation of how these audits work. It is not ArkCloud's schedule: none of these steps has started.
Scoping
The service provider and a CPA firm agree the system boundary and which Trust Service Criteria are in scope.
Readiness assessment
Controls and their documentation are reviewed for gaps before the observation period begins.
Observation period
Controls operate for an agreed period while evidence of their operation is retained.
Testing
The auditor samples that evidence and tests whether each control operated effectively.
Report
The auditor issues the report: opinion, management's assertion, system description, controls, tests and exceptions.
No SOC 2 report to share
No SOC 2 report is held, and no audit has been engaged yet. The controls that exist are documented on the security documentation and the public security page. If your review needs a security questionnaire completed, email [email protected].