When enterprises evaluate verification infrastructure, one of the first questions they ask is: "Are you SOC 2 certified?" It is the right question. SOC 2 Type II is the gold standard for demonstrating that a SaaS platform operates with rigorous security controls — not just on paper, but in daily practice. This post explains what SOC 2 Type II involves, why it matters for verification platforms specifically, and the security controls we implement at Truthlocks as we work toward formal certification.
What Is SOC 2 Type II?
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA) for evaluating an organization's controls relevant to security, availability, processing integrity, confidentiality, and privacy. A Type II report goes beyond design assessment — an independent auditor tests whether controls operated effectively over a sustained observation period of at least six months.
For verification infrastructure — which handles sensitive identity data, cryptographic keys, and credential records — SOC 2 coverage across all five Trust Service Criteria is particularly important.
Security Controls We Implement
Regardless of formal certification status, the controls themselves are what protect customer data. Here are the key security measures we have in place at Truthlocks:
- Access management: Role-based access control with multi-factor authentication. Privileged access is logged to an immutable audit trail.
- Encryption: Data encrypted at rest with AES-256 and in transit with TLS 1.3. Cryptographic signing keys are managed with strict access controls and rotated on a defined schedule.
- Change management: All code changes require peer review, pass automated security scanning, and are deployed through a CI/CD pipeline with separation of duties.
- Incident response: Documented incident response procedures with defined escalation paths and post-incident reviews.
- Monitoring and alerting: Continuous infrastructure and application monitoring with automated alerting for anomalous behavior and unauthorized access attempts.
- Tenant isolation: PostgreSQL row-level security policies ensure that each customer's data is isolated at the database level — a critical control for multi-tenant verification platforms.
Why SOC 2 Matters for Verification Platforms
Verification infrastructure occupies a uniquely sensitive position in the trust chain. A compromise of the verification platform could allow fraudulent credentials to pass as valid, or legitimate credentials to be falsely rejected. SOC 2 controls address this by ensuring:
- Key management integrity: Cryptographic signing keys are protected throughout their lifecycle, from generation to rotation to destruction.
- Audit trail completeness: Every state change — issuer registration, credential issuance, verification, revocation — is recorded in a tamper-evident log.
- Availability guarantees: Verification services must be available when credentials need to be checked. SOC 2 availability controls cover redundancy, failover, and disaster recovery.
Our Path Forward
Truthlocks is actively working toward SOC 2 Type II certification. We have implemented the controls described above and are building the documentation, evidence collection, and monitoring processes required for a formal audit. We will share updates on this page as we reach milestones in the certification process.
In the meantime, enterprise customers who need to evaluate our security posture can request a detailed security questionnaire response or schedule a call with our security team through the enterprise contact page.
Security is foundational to everything we build. Whether or not a certificate hangs on the wall, the controls that protect your data are in place and operating today. For details on our security architecture, visit the security page.