Our first SOC 2 Type II report is finished

<p>We have finished our first SOC 2 Type II examination. The observation window ran from 1 October 2025 to 31 March 2026, which is six months of evidence rather than a snapshot of one good day, and the report closed with no exceptions raised.</p><p>Five areas were in scope: access control, change management, encryption of customer data in transit and at rest, availability of the flow runner and the API, and how we handle an incident once it starts. That covers the production environment, the deploy pipeline and the support tooling our team uses to look at a failing run. The marketing site and this news page are outside the scope, and we would rather say that plainly than let the badge imply more than it covers.</p><p>Two things changed during the window because the audit made us look. Session tokens for the internal admin tool used to last thirty days and now last eight hours, and every read of a customer record payload by an employee now writes an audit line naming the person, the record and the support ticket it belongs to. Neither was a breach and neither was pleasant to find, which is roughly what an audit is for.</p><p>The firm that performed the examination is named inside the report itself. We share the full report, the management assertion and the bridge letter under a mutual NDA, so email security@syncline.topclb.com and we will send the packet the same working day. If you only need the summary for a vendor questionnaire, the security page now carries a one page control overview with no NDA attached.</p><p>The next window has already started and runs to 30 September 2026. We plan to keep a rolling annual report from here, so there is never a stale gap between one examination and the next.</p>