Documentation Index

Fetch the complete documentation index at: https://qwady.wiki/llms.txt

Use this file to discover all available pages before exploring further.

​

SOC 2 Type II Roadmap

​

What Is SOC 2 Type II?

SOC 2 (System and Organization Controls 2) is a widely recognized audit framework developed by the AICPA. It evaluates an organization’s controls relevant to security, availability, processing integrity, confidentiality, and privacy.

• Type I — point-in-time assessment: “Are the right controls designed and in place?”
• Type II — period-of-time assessment: “Did these controls operate effectively over 3–12 months?”

Type II is the gold standard for enterprise procurement because it proves sustained operational discipline, not just a snapshot.

​

Why SOC 2 Matters for ThornGuard

ThornGuard sits in the critical path of AI agent traffic — inspecting tool calls, redacting sensitive data, and enforcing security policies. Enterprise customers need assurance that:

• Audit logs are tamper-resistant and retained appropriately
• Access controls (license keys, license activations, OAuth) are properly enforced
• PII redaction operates consistently and correctly
• The proxy infrastructure itself is secured against compromise

SOC 2 Type II attestation provides this assurance through independent third-party verification.

​

Planned Scope

​

Initial Scope: Security (CC) Only

The first SOC 2 cycle will focus exclusively on the Security common criteria (CC6.x, CC7.x, CC8.x). This covers: Additional trust services criteria (Availability, Confidentiality, Processing Integrity, Privacy) can be added in subsequent audit cycles as the program matures.

​

Timeline

The estimated timeline from kickoff to report issuance is 7–8 months:

​

Cloudflare Carve-Out

ThornGuard runs entirely on Cloudflare’s infrastructure:

• Cloudflare Workers — compute
• D1 — structured data (audit logs, settings, OAuth tokens)
• KV — caching (license validation, baselines)
• Durable Objects — stateful processing (rate limiting, anomaly detection)
• Queues — async webhook delivery

Cloudflare maintains its own SOC 2 Type II report. Using the AICPA carve-out method, ThornGuard’s audit can reference Cloudflare’s report for infrastructure-level controls, significantly reducing the scope to:

• Application-layer access controls (license auth, license activations, OAuth)
• Data handling practices (PII redaction, audit retention, GDPR purge)
• Change management (feature flags, migration-based schema changes)
• Monitoring and incident response (anomaly detection, webhook alerting)

This carve-out approach is standard practice for cloud-native SaaS products and reduces both audit cost and timeline.

​

Current Controls Mapping

ThornGuard already implements controls that map to SOC 2 Security criteria:

​

Compliance Platform

Two leading platforms are under evaluation: Both platforms provide policy templates, automated evidence collection, and auditor coordination. The final selection will depend on Cloudflare integration depth at the time of kickoff.

​

Estimated Costs

These estimates assume a focused Security-only scope with the Cloudflare carve-out. Adding additional trust services criteria would increase auditor fees by approximately $5–10K per criterion.

​

Next Steps

1. Select compliance platform and begin gap analysis
2. Author formal security policies (access control, incident response, change management)
3. Configure automated evidence collection for existing ThornGuard controls
4. Begin the observation period
5. Engage independent auditor for fieldwork