Why SOC 2 Type II
When you upload a contract, you're trusting us with your most sensitive business data. That trust has to be provable.
SOC 2 Type II is the auditable answer. Not a self-attestation — a third party examines your controls for 6 to 12 months and reports what they found.
We just finished our Type II window. Report available on request to security@pdfpilot4u.com.
What we did
Technical controls
- AES-256-GCM for data at rest (Postgres + Cloudflare R2)
- TLS 1.3 for all network hops
- HSM-backed key rotation every quarter
- Short-lived access tokens (60-minute TTL) with refresh rotation + Redis JTI blocklist
- MFA mandatory for admin accounts
Operational controls
- Incident response runbook with a 4-hour RTO for critical systems
- Quarterly access reviews — every employee's permissions re-approved
- Mandatory security training at hire + annually
- Separation of duties — deploy access ≠ prod DB access ≠ audit log read access
Data handling
- 24-hour default retention for uploaded files; configurable up to 90 days
- Permanent deletion on request with cryptographic deletion certificates
- Zero training on customer documents — contractually enforced
- Regional data residency available on Business+
What's next
- ISO 27001 — in progress, targeting Q3 2026
- HIPAA BAA — available on Enterprise today; pursuing formal HITRUST certification
- FedRAMP Moderate — evaluating feasibility for government customers
The honest part
A SOC 2 report doesn't mean you're unhackable. It means you have documented controls, tested over time, and an auditor who agrees. That's the floor — we keep pushing past it.
Questions? security@pdfpilot4u.com.