SOC 2 Type II for Lead Routing

SOC 2 is a security and controls framework published by the AICPA (American Institute of Certified Public Accountants). It defines a set of Trust Services Criteria that a service organization can be audited against by an independent CPA firm. SOC 2 is not a government regulation. It is an attestation framework that enterprise buyers rely on when their procurement and security teams perform vendor reviews. A valid SOC 2 report is what replaces a long back-and-forth security questionnaire in most enterprise deals.

There are two flavors of SOC 2 report. Type I is a point-in-time attestation that the design of the controls is suitable as of a specific date. Type II goes further. It covers an observation window (commonly six to twelve months) during which the auditor checks that the controls were not only designed correctly but actually operated effectively over time. Most enterprise security reviews require Type II, because it demonstrates sustained performance rather than a snapshot.

The framework has five Trust Services Criteria. Security is the required baseline and every SOC 2 report includes it. The other four (Availability, Processing Integrity, Confidentiality, Privacy) are optional additions and a service organization picks the ones that matter to its customers. For a B2B platform like Lead Router that moves customer PII between partners and buyers, Availability and Confidentiality are always in scope and Processing Integrity matters because contracts, caps, and billing must be correct.

Enterprise buyers (insurance carriers, banks, healthcare groups, publicly traded media companies) require SOC 2 because their own auditors require it of them. When one of your large customers asks for a SOC 2 report, they are not asking a polite question. Their procurement process will not close the deal without a valid attestation. This page exists so their security team can start the review without waiting on us.

The SOC 2 Type II audit is in progress during 2026 with an independent CPA firm. The scope covers the Security, Availability, and Confidentiality Trust Services Criteria at minimum, with Processing Integrity and Privacy included through related controls. Controls documentation is in place, the control environment is live in production, and the auditor is in the evidence collection phase of the observation window.

We will publish the attestation date on this page once the auditor issues the final Type II report. The full report will be available to qualified prospects under a mutual NDA at that point. We will not claim "SOC 2 compliant" or "SOC 2 certified" until the attestation is actually in hand. Anyone who claims either of those phrases without an issued report is misusing the framework.

In the meantime, the controls described on this page are already enforced in production. An enterprise security team can review the architecture today, issue their standard vendor questionnaire, and proceed with procurement on the understanding that the Type II report is pending.

A public summary describing the scope, the Trust Services Criteria in scope, and the current attestation status is available on this page. This is enough for most vendor security questionnaires to get started. If the buyer needs the full Type II report, contact sales@iscale.com and the sales team will route the request to the security contact.

The full SOC 2 Type II report will be made available to qualified prospects under a mutual NDA once the auditor issues it. We do not post the full report publicly because it contains control detail that is only appropriate for an audience performing a security review under confidentiality terms. Every enterprise vendor operates this way.

If a prospect needs the report before the Type II observation window closes, we can share the Type I design report covering the same control framework as a point-in-time attestation. Ask the sales team when you make the request.