SOC 2 at RecordX
What SOC 2 is, and why it takes time
SOC 2 is a report issued by an independent auditor confirming that a service organization's controls meet the AICPA Trust Services Criteria (Security, plus optionally Availability, Confidentiality, Processing Integrity, and Privacy). A Type I report describes the design of controls at a point in time; a Type II report tests those controls' operating effectiveness over an observation period, typically six to twelve months.
A Type II audit is not something a startup can shortcut. It requires a documented control set, evidence collection running for months, and an independent CPA firm to attest to the result. RecordX is walking that path but has not finished it. Anyone who tells you they got a Type II report in a week is telling you something else.
Controls we run today, mapped to SOC 2 Common Criteria
| Common Criteria | What RecordX does |
|---|---|
| CC1 - Control environment | Documented security policies, code-review requirement on every production change, defined roles. |
| CC2 - Communication and information | Security contact published (security@recordx.io), incident-response runbooks, external-facing security and privacy pages. |
| CC3 - Risk assessment | Blast-radius review before every AWS live-state change. Dependency and container scanning in CI. |
| CC4 - Monitoring activities | CloudWatch alarms on service health, log aggregation, audit logs on authentication and administrative actions. |
| CC5 - Control activities | IAM policies scoped per service, separated dev and prod AWS accounts, deployment via wrapper scripts (never direct CLI mutations). |
| CC6 - Logical and physical access | Managed identity (AWS Cognito), short-lived session tokens, signed pre-signed URLs for storage, least-privilege IAM roles. Physical security inherited from AWS. |
| CC7 - System operations | Continuous vulnerability scanning, patching through the normal release cycle, alerting on production regressions. |
| CC8 - Change management | All production code changes go through peer review. Deploys run through versioned wrapper scripts with pre-deploy checks. Terraform tree is dormant; IAM changes go through auditable snapshot scripts. |
| CC9 - Risk mitigation | Vendor due diligence on sub-processors, incident-response runbooks, environment isolation. |
SOC 2 at the platform layer
RecordX runs on AWS in the eu-central-1 region. AWS holds SOC 1 Type II, SOC 2 Type II, and SOC 3
attestations for the underlying platform (compute, storage, network, key management). RecordX inherits those
controls for the platform layer, and adds application-layer controls on top - the mapping above.
What we can send to a procurement reviewer today
- A security controls summary mapped to the SOC 2 Common Criteria (the table above, in longer form).
- A completed vendor security questionnaire (SIG Lite, CAIQ, or a custom template).
- Sub-processor list and DPA on request.
- AWS's public SOC 2 report metadata (the AWS report itself is available under NDA through AWS Artifact).
- Penetration test summary under NDA (as of the last engagement).
Roadmap
A SOC 2 Type II audit engagement is planned. We are not yet in an observation window. If SOC 2 Type II is a hard requirement for your procurement, tell us your timeline and we will tell you honestly whether we can meet it - we will not promise a report we cannot deliver.
Contact us for a security review
Email security@recordx.io to request our controls documentation, questionnaire response, or to schedule a security review. We respond within two business days.
Related reading: Security overview, Compliance overview, GDPR, HIPAA.