SOC 2 roadmap
SOC 2, in the open.
Where we are on the way to a SOC 2 report, what is already in place, and what a buyer can rely on before the report exists. The dates are targets. We update this page when they move, rather than let it drift.
The roadmapUpdated 8 November 2026
- 01Controls mapped to the criteriaDone · 2026
The Trust Services Criteria for security, availability and confidentiality, mapped to the controls the platform already enforces: identity, tenant isolation, residency, audit, encryption, the signed supply chain and observability.
- Security
- Availability
- Confidentiality
- 02Evidence collected continuouslyIn progress · Now
Automated evidence from the cloud account, the code repository, the identity provider and the build pipeline, so the auditor reads a feed rather than a folder of screenshots, and a control that stops holding is seen the day it stops.
- Cloud account
- Repository
- Identity provider
- CI
- 03The written policies and the people sideIn progress · Before Type 1
Access, change management, incident response, vendor management, business continuity and acceptable use, written down and followed. Background checks and security training as the team grows beyond one.
- Policies
- Onboarding and offboarding
- Training
- 04SOC 2 Type 1Target · First half of 2027
A point-in-time report that the controls are designed and in place, targeted ahead of the first design-partner go-live so the first hotel's reviewer has a report to read.
- Design of controls
- Independent auditor
- 05SOC 2 Type 2Target · Early 2028
The controls observed operating over a window of at least six months after Type 1. This is the report a hotel group's procurement team asks for, and the one we build toward.
- Six-month observation window
- Operating effectiveness
- 06ISO 27001:2022Target · After Type 2, if customers ask
Technical controls are already aligned to Annex A and maintained beside the code. Certification follows Type 2 when a customer in the EU needs it on paper.
- Annex A aligned today
In the meantimeWhat a buyer can rely on today
Inherited certificationsThe platform runs on Amazon Web Services, with the physical, datacentre and host controls covered by AWS's own SOC 2 and ISO 27001 reports.
The whitepaperEvery control on this roadmap is described as built, not as planned, in the security whitepaper, with the parts that are still on the bench listed separately.
The recordAn append-only event log under every change. A reviewer can see what happened in a tenant, and that nothing in the history was edited after it happened.
Your questionnaireWe answer security questionnaires against the product. Bring yours, and the people who have to sign off, to a briefing.
Request a briefing
Bring your security
questionnaire.
We answer it against the product, with the engineer who built the controls on the call.
Book a briefingsecurity@aerandil.com for disclosures. privacy@aerandil.com for the DPA.