Newer version available: we have since published a fuller guide, SOC 2 Type II, explained for buyers. For our current certification status — including what we have not yet achieved — see security and compliance.
"SOC 2 compliant" is one of the most misused phrases in B2B SaaS. A Type I report tells you a vendor's controls were designed correctly on a single day. A Type II report tells you those controls actually operated effectively over a period — typically 3 to 12 months.
What the auditor checks
A Type II engagement typically covers the Trust Services Criteria for Security, and often Availability and Confidentiality. The auditor pulls real evidence across the audit window rather than accepting a description of intent: change tickets, access reviews, incident logs, vendor risk assessments, encryption configuration, and telemetry showing the controls actually fired.
Where KaryaFlow stands
We have not completed a SOC 2 audit. Our controls are built against the Trust Services Criteria and the audit is planned, but no report exists and we will not imply one does. ISO 27001 is scoped and on the roadmap. We make no HIPAA claim.
An earlier version of this post described an audit and a report that we do not have. That was wrong, and correcting it here is more useful than quietly deleting the page. Current status always lives on security and compliance.
Why this matters for AI agents
AI agents that act on production data raise the bar for security controls, certification or not. What we can show today is the mechanism: every agent action is logged, approvals are enforced on actions that change data, and secrets are scoped to the minimum privilege required. Ask any vendor to demonstrate that live rather than to name a standard.