Skip to main content
X3
X3 COMPASS
AI Safety Director
Sign in★ Start free →
Compliance → SOC 2 Type II

SOC 2 Type II. Honest progress.

We are in active preparation for a SOC 2 Type II attestation against the Security Trust Services Criteria. The plan is below — done, doing, and to-do, dated by month. Target attestation: Q4 2026.

For the underlying security architecture, see /security. For the customer-trust summary, see /trust.

Scope (Phase 1)
Security TSC only
Controls in matrix
32 (CC1 to CC9)
In place today
26 of 32 · 81%
Target attestation
Q4 2026

Phase 2 (Availability + Confidentiality TSC) follows attestation. ISO 27001 is on the roadmap post-SOC 2 if customer demand is there.

What's already in place

Access control
MFA required on every admin account; 1Password for credentials; no shared logins; quarterly access review policy in force.
Tenant isolation
Row-Level Security on every compass_* table. The same policy ships on every new table at creation time.
Encryption
AES-256 at rest (Supabase + R2). TLS 1.3 + HSTS in flight. We never store payment card data — Stripe handles all of it.
Vendor management
Sub-processor list published. DPAs on file with every Critical and Important vendor. Status pages polled by Fort Knox.
Incident response
Severity tiers P1 to P4. Doctor agent drives the first 15 minutes of every alert. 72-hour customer notification SLA under our DPA.
Monitoring
Fort Knox v4 — uptime probes, journey probes, deploy watcher, vendor pollers, client-error aggregator, eCFR citation verifier.
Change management
Every production change ships through GitHub + Cloudflare Pages with automatic preview deploy + journey-probe gate.
Source-code audit
All infrastructure-as-code and Pages Functions are reviewable in github.com/x3fleetsafety. No secrets in source — pre-commit gitleaks planned Q3.

Monthly milestones to attestation

We update this table on the first business day of every month. If a milestone slips, the new date is published here with the reason — we will not retroactively edit past dates.

QuarterWhenMilestoneStatus
Q2 2026May 2026Trust Services Criteria gap analysis (Security TSC, 32 CC controls)✓ Done
Q2 2026May 2026Controls matrix published internally (compliance/soc2/CONTROLS.md)✓ Done
Q2 2026May 2026Risk register published internally (compliance/soc2/RISK_REGISTER.md)✓ Done
Q2 2026May 2026Access Control / Vendor Management / Incident Response policies signed✓ Done
Q2 2026Jun 2026Auditor selection (Big-Four-adjacent vs. boutique CPA firm) — shortlist + intro calls→ In progress
Q3 2026Jul 2026Engagement letter signed; readiness assessment begins (Type I review of design effectiveness)Scheduled
Q3 2026Jul 2026Quarterly access review #1 completed and filed; vendor sub-processor list snapshotScheduled
Q3 2026Aug 2026First incident-response tabletop drill (scenario: leaked Supabase service-role key)Scheduled
Q3 2026Sep 2026Type I letter received; observation period begins (minimum 3 months for Type II)Scheduled
Q4 2026Oct 2026Monthly Fort Knox + access-review evidence collection rolling forwardScheduled
Q4 2026Nov 2026Second incident-response drill (scenario: vendor outage with data-exposure ambiguity)Scheduled
Q4 2026Dec 2026SOC 2 Type II report issued (Security TSC, 3-month observation window)Scheduled

Open gaps before the observation period

Honest list. Each gap has a planned close date. If we miss one, we update this table the month it slips.

GapClosing by
Formal evidence-collection schedule (which evidence, when, by whom)Jul 2026 — part of readiness assessment
Annual penetration test by an outside firmQ3 2026 — booked after auditor selection
Bus-factor mitigation (single founder is the highest-rated risk in the register)Ongoing — staged via documented runbooks + Fort Knox automation; first hire decision Q3 2026
Vulnerability disclosure program with a bug bounty payoutQ4 2026 — [email protected] is live and triaged today
Customer-facing audit-log retention beyond Cloudflare's default windowsQ3 2026 — Supabase audit table + R2 archive

Need the controls coverage today?

If your security review needs the controls matrix, sub-processor list, DPA, or a written response to a SIG / CAIQ questionnaire before our Type II report is issued, email [email protected].

Initial reply within 24 hours. We answer enterprise security questionnaires directly — no portal, no gatekeeping.

Related
Security architecture →
Cloud architecture, RLS, encryption, incident response — the deeper read.
Trust summary →
Customer-trust overview: who we are, what we promise, what we don't.
Changelog →
Public log of shipped changes and any customer-visible incidents.