Current status
Controls mapped and operating. Independent audit not yet started — no SOC 2 report exists, and we will not claim one until an auditor issues it.
CC6 · Logical access
Who can reach what, and how that is enforced.
- Row-level policies on every table, keyed to organization membershipAvailable
- Roles stored apart from user profiles; only admins change themAvailable
- New members join only by invitation or admin-approved requestAvailable
- Outside investors see only verified findings on deals shared with themAvailable
- SAML single sign-on and enforced MFAPlanned
CC7 · System operations
Detecting and recording what happens.
- Append-only audit log written by database triggersAvailable
- Finding verifications record reviewer and timestampAvailable
- Automated security alerting and incident runbookPlanned
CC8 · Change management
How the product itself changes.
- Database changes applied as versioned migrationsAvailable
- Automated tests on citation, reporting, and pipeline rulesAvailable
- Formal change-approval recordsPlanned
C1 · Confidentiality
Keeping deal data private.
- Private document storage partitioned by firm and dealAvailable
- AI analysis runs as the signed-in user, one document at a timeAvailable
- Deleting a document removes its extracted text and findingsAvailable
- Documented data-retention schedulePlanned
PI1 · Processing integrity
Making sure outputs are accurate.
- Every AI finding carries a verbatim quote checked against the source pageAvailable
- Unmatched quotes are flagged; OCR pages carry a confidence scoreAvailable
- Only analyst-verified findings appear in executive summariesAvailable
For audit firms
System description
Service
A due diligence workspace where firms upload deal documents, receive AI-extracted findings with verbatim source citations, and have analysts verify them before anything is shared.
Infrastructure
Application runs on a managed edge runtime; data lives in a managed Postgres database and private object storage operated by our cloud provider (subservice organisation, carved out).
Data boundaries
Every record is tagged to one firm. Database policies on every table check membership on every request; files are stored under firm and deal folders that storage policies enforce.
People and roles
Firm admins, analysts and reviewers are assigned per firm. Outside investors are not members and only reach verified findings and shared memos through restricted functions.
AI processing
Documents are analysed as the signed-in user through an AI gateway. Customer data is not used to train models. Findings without a matching source quote are flagged, and only analyst-verified findings reach summaries.
Encryption
TLS in transit; AES-256 at rest as provided by our cloud provider (provider claim, not independently verified by us).
Privacy controls
- Customer data processed only to provide the service; never soldAvailable
- Customer data not used to train AI modelsAvailable
- Per-deal and per-firm retention periods with automatic nightly deletionAvailable
- Deleting a document removes its extracted text and findingsAvailable
- Early-access signups visible only to the account ownerAvailable
- Breach notification to customer admins within 72 hours of confirmationAvailable
- Published privacy policy (see /privacy)Available
- Data subject request procedure (access, correction, deletion, 30-day response)Available
Evidence index
Evidence we can make available to an engaged audit firm on request.
| Control area | Evidence | Status |
|---|---|---|
| CC6 Access | Database policy definitions and role assignments per firm | Available |
| CC6 Access | Cross-firm isolation test results (automated, re-run after policy changes) | Available |
| CC7 Operations | Append-only audit log export | Available |
| CC7 Operations | Processing monitor and failed-job retry history | Available |
| CC8 Change | Versioned database migration history and automated test runs | Available |
| C1 Confidentiality | Retention cleanup run logs | Available |
| PI1 Integrity | Citation-match and reviewer verification records | Available |
| CC1–CC5 | Written company policies: access, incident response, change, vendor, retention, risk (see /policies) | Available |
| CC1–CC5 | Signed policy acknowledgements, risk register and vendor review records over time | Planned |
Road to the report
- 01Available
Map controls to the Trust Services Criteria
Done — shown on this page.
- 02Available
Write policies (access, incident, vendor, retention)
Done — published on the policies page.
- 03Planned
Engage an independent CPA firm for a Type I audit
Not started.
- 04Planned
Type II observation period
After Type I.
Management statement · for signature
Management statement on the Analivo Technologies control environment (SOC 2 Type I readiness)
1. Scope. This statement describes the design of Analivo Technologies’ controls, as of the date below, against the AICPA Trust Services Criteria for Security and Confidentiality. Controls marked live on this page are in operation; controls marked planned are not yet in place.
2. Data ownership. Each customer firm owns all documents it uploads and all findings, notes and memos derived from them. Analivo Technologies processes customer data only to provide the service, does not sell it, and does not use it to train AI models. Customers may export their data and may set retention periods after which documents, extracted text and findings are deleted automatically.
3. Access. Customer data is isolated per firm by database policies enforced on every request. Only members admitted by invitation or administrator approval can access a firm’s deal rooms; roles are assigned by firm administrators. Outside investors see only analyst-verified findings and shared memos for deals explicitly shared with them. Every access-relevant change is written to a tamper-resistant audit log.
4. Breach procedures. If we confirm unauthorised access to customer data, we will (a) contain the incident and revoke affected credentials, (b) notify affected customers’ administrators without undue delay and in any case within 72 hours of confirmation, (c) describe the data involved, likely consequences and measures taken, and (d) preserve audit records and publish a post-incident review to affected customers.
5. Audit status. Analivo Technologies has not yet completed a SOC 2 Type I or Type II examination. This is management’s own statement, not an auditor’s report. A SOC 2 report can only be issued by an independent licensed CPA firm; we will publish it when one has been issued.
This is a statement by Analivo's management. It is not an independent auditor's opinion or a SOC 2 report.
Signed
Title
Date
2026-11-12
Typing your name acts as your signature. Choose "Save as PDF" in the print dialog, then publish the file.