Preparing for SOC 2 Type II
AES-256-GCM field-level encryption, multi-factor sign-in, role-based access control, audit logging and automated backups are live in production today. We are preparing for an independent SOC 2 Type II audit and will publish the report once it is complete.
Trust service criteria. Security (CC) · Availability (A) · Confidentiality (C) · Processing integrity (PI) · Privacy (P).
Programme status
| Phase | Window | Status |
|---|---|---|
| Core controls (encryption, access, logging, backups) | Today | Live |
| Readiness assessment with an auditor | Before audit | Planned |
| Observation period | After readiness | Planned |
| Type II report | After observation | Planned |
Control evidence
- Access control. Role-based access, multi-factor sign-in, session revocation
- Encryption. TLS in transit; AES-256-GCM field-level encryption at rest for vault, life-care/medical, biography, financial, asset, beneficiary, digital-account, medication, and medical-contact records; every uploaded file sealed with its own AES-256-GCM key; exports locked with a member-held passphrase
- Monitoring & availability. /api/health, /status, automated backups
- Audit & integrity. Audit logs, Zod validation on all API inputs
- Privacy & subprocessors. Export/delete flows, DPAs, published subprocessor list
Full mapping: docs/SOC2_CONTROLS.md · programme charter: docs/SOC2_TYPE_II_PROGRAMME.md
Enterprise & family office requests
Family offices and enterprise clients may request our control mapping now, and the report summary under NDA once the audit is complete.
Email security@helauloom.com with your organisation name and NDA contact. We respond within two business days with the readiness attestation letter or report summary when available.