Compliance
SOC 2 status, honestly stated
InNumber does not hold a SOC 2 report today. No audit has been performed and no opinion has been issued. This page is our working status board: the controls already operating, the ones being built, and the audit path we are following.
If your procurement process requires a completed SOC 2 report before purchase, we do not meet that bar yet. Tell us your deadline and we will tell you honestly whether our timeline can meet it.
Current report
None
No Type I or Type II report issued.
Controls in place
5/13
Operating in the product today.
Controls in progress
2
Being implemented before paid onboarding.
Target Type I
3–6 months
Subject to readiness and auditor scheduling.
Control status
| Area | Control | Status | Detail |
|---|---|---|---|
| Data handling | Reconciliation runs in the browser | In place | Ledger and bank files are read and matched on the device. Matching does not require the file to reach our servers. |
| Data handling | Tenant scoping in the close engine | In place | Close data is scoped to a single workspace; the engine performs no cross-tenant reads. |
| Audit trail | Append-only run log | In place | Every engine action records actor, timestamp, parameters and result. Entries are not editable from the product. |
| AI governance | Citation-required model output | In place | AI comments are rejected server-side without a citation to an in-scope account, rule or task. The model never posts or clears an item. |
| Encryption | TLS in transit, encryption at rest | In place | Provided by our hosting and database platform for all stored close data. |
| Access control | Authentication and per-workspace authorisation | In progress | Sign-in and workspace isolation policies are being implemented before paid onboarding opens. |
| Access control | Role-based permissions and least privilege | In progress | Preparer, reviewer and admin roles with documented approval for privilege changes. |
| Policies | Written security, onboarding and offboarding policies | Planned | Information security policy set, acceptable use, incident response and business continuity. |
| Vendor management | Subprocessor register and vendor risk reviews | Planned | Published subprocessor list with annual review of each vendor's own attestations. |
| Monitoring | Continuous control monitoring and evidence collection | Planned | Compliance automation platform collecting evidence continuously rather than at audit time. |
| Testing | Independent penetration test | Planned | Annual third-party test with remediation tracked to closure. |
| Audit | SOC 2 Type I report | Planned | Point-in-time opinion on control design from a licensed CPA firm. |
| Audit | SOC 2 Type II report | Planned | Opinion on operating effectiveness across a continuous observation window. |
Certification roadmap
Dates are targets, not commitments — an auditor sets the final schedule. We will update this page as each phase completes.
Phase 1 — Foundations
- Authentication and workspace isolation across the product
- Role-based permissions with documented approvals
- Security policy set drafted and adopted internally
Phase 2 — Readiness
- Compliance automation platform in place with continuous evidence collection
- Subprocessor register published and vendor reviews completed
- Independent penetration test and remediation
Phase 3 — Type I
- Readiness assessment with a licensed CPA firm
- Gap remediation against the Trust Services Criteria
- Type I report issued on control design
Phase 4 — Type II
- Three to six month observation window with controls operating
- Evidence sampling and audit fieldwork
- Type II report issued, then renewed annually
Trust Services Criteria in scope
Security
In scope for Type I and Type II.
Availability
In scope for Type II.
Confidentiality
In scope for Type II.
Processing integrity
Under consideration — relevant to deterministic matching.
Privacy
Out of scope for the first report.
What you can ask us for today
- A written description of how reconciliation data is handled and where it is processed.
- Our current subprocessor list for hosting, database and AI inference.
- A completed security questionnaire covering encryption, access and logging.
- Our incident notification commitment in writing as part of a trial agreement.
Start a trial and ask for the security pack in the first message — we will send what exists and be explicit about what does not.