Trust and security, in plain terms.
You're evaluating a platform that will hold your control environment. Here's how we protect it, and what we'll share with you under NDA.
Independent assurance
TruOps holds a SOC 2 Type II report covering all five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The full report is available to customers and prospects under NDA through a security review.
| Item | Detail |
|---|---|
| Report | SOC 2 Type II |
| Criteria | Security · Availability · Processing Integrity · Confidentiality · Privacy |
| Most recent period | 15 November 2024 to 15 May 2025 |
| Access | Under NDA: request a security review |
How a security review works
Request a security review (or email hello@truops.ai) and we'll send the following under NDA, then walk you through it:
- The current SOC 2 Type II report.
- A current list of subprocessors and a description of our hosting. We keep these in the NDA packet so they're always up to date.
- A conversation about our data processing addendum, including how customer content is used. It's never used to train foundation models.
- Enough architecture detail to evaluate tenant isolation, encryption in transit and at rest, access control, and logging.
- Answers to your SIG, CAIQ, or custom security questionnaire, pre-filled from our own program with sources, and gaps left for a person.
How the platform protects you
- Tenant isolation. Every environment, whether an enterprise, an MSSP client, or a portfolio company, has its own data, evidence, and access controls. Data never moves between environments, and every switch between them is logged.
- Fine-grained access. Role- and attribute-based permissions apply to people and AI agents alike. TruPilot can only see and do what the person asking can.
- Least-privilege integrations. Connectors connect to Azure, AWS, Google Cloud, Entra ID, Okta, Intune, Defender, CrowdStrike, Tenable, Qualys, GitHub, and Azure DevOps using least-privilege permissions you can revoke at any time.
- One audit log. Every action, by a person or an agent, is recorded. Completed assessment results are saved as of their date.
- AI data use. Your documents, telemetry, and corrections improve your own environment only. They're never used to train foundation models or shared with other customers. See Commitments.
What we share under NDA
Here's what we share on request. If something you need isn't listed, just ask and we'll cover it under NDA.
| Question | Answer |
|---|---|
| Does TruOps hold an ISO 27001 certification? | Our current customer-facing assurance is SOC 2 Type II, covering all five criteria. |
| Where is data hosted? | We cover hosting and subprocessors in the security review, where the details are always current. |
| Do you pentest? | Ask us during the security review and we'll walk you through our testing. |
| Can we have a DPA / BAA? | We handle these during contracting. If you need a BAA, mention it in your security review request. |
| Incident reporting | Email hello@truops.ai with "Security incident" in the subject line. Notification terms are set out in your agreement. |
How to evaluate our AI as a control
If TruOps will draft assessments in your environment, evaluate the AI the way you'd evaluate a contractor with privileged access.
- ProvenanceEvery drafted answer should show its source and confidence score. If there's no source, it should stay blank.
- Separation of dutiesWhatever produced a value shouldn't be able to approve it. Watch an assessment go through approval in a demo.
- LoggingEvery accept, reject, and override should go into the same audit log as human work.
- ScopeAgents and connectors should have the least access they need.
- DecayStatus should drop when evidence gets old. A control that stays green forever isn't being monitored.
We cover this in more detail in Agents without a human gate.
Our AI commitments
How TruOps' AI behaves (citing sources, never approving its own work, routing by confidence, limited access, asking when unsure, and one audit log) is laid out on our Commitments page. That page covers how the product works. This one covers the security review.
Questions
Does TruOps have a SOC 2 report?
Yes. TruOps holds a SOC 2 Type II report covering Security, Availability, Processing Integrity, Confidentiality, and Privacy, for the period 15 November 2024 to 15 May 2025, available under NDA.
Is customer data used to train AI models?
No.
Can we see subprocessors and hosting?
Yes, under NDA, as part of a security review. We keep the current list in the security packet so it's always up to date.
Does TruOps replace our auditor?
No. Only a licensed auditor can issue a SOC 2 report. TruOps keeps your program and evidence ready for fieldwork.
How do I start a security review?
Use the contact form and choose "A security review," or email hello@truops.ai. Send your NDA or use ours, along with any questionnaire you need us to complete.
Related
How TruOps' AI behaves and how to check it in a demo.
→LearnAgents without a human gateWhy a GRC agent with no human approval step is a liability.
→PlatformIntegrationsYour security stack plus 800+ integrations for cloud, identity, EDR, HRIS, ITSM, and other tools.
→PlatformMulti-tenantGive every client or entity its own space, with one view across all of them.
→See it run on your own data.
Book 30 minutes with a GRC specialist. Bring a real document, like a SOC 2 report, risk register, or vendor list (redacted is fine), and we'll show TruOps AI working on it.