SOC 2 Type II Roadmap
ThornGuard is not currently SOC 2 certified. This page describes the planned roadmap toward attestation.
What Is SOC 2 Type II?
SOC 2 (System and Organization Controls 2) is a widely recognized audit framework developed by the AICPA. It evaluates an organization’s controls relevant to security, availability, processing integrity, confidentiality, and privacy.
- Type I — point-in-time assessment: “Are the right controls designed and in place?”
- Type II — period-of-time assessment: “Did these controls operate effectively over 3–12 months?”
Type II is the gold standard for enterprise procurement because it proves sustained operational discipline, not just a snapshot.
Why SOC 2 Matters for ThornGuard
ThornGuard sits in the critical path of AI agent traffic — inspecting tool calls, redacting sensitive data, and enforcing security policies. Enterprise customers need assurance that:
- Audit logs are tamper-resistant and retained appropriately
- Access controls (license keys, team tokens, OAuth) are properly enforced
- PII redaction operates consistently and correctly
- The proxy infrastructure itself is secured against compromise
SOC 2 Type II attestation provides this assurance through independent third-party verification.
Planned Scope
Initial Scope: Security (CC) Only
The first SOC 2 cycle will focus exclusively on the Security common criteria (CC6.x, CC7.x, CC8.x). This covers:
| Criteria Group | Focus Area |
|---|
| CC6 | Logical and physical access controls |
| CC7 | System operations and monitoring |
| CC8 | Change management |
Timeline
The estimated timeline from kickoff to report issuance is 7–8 months:
| Phase | Duration | Activities |
|---|
| Gap Analysis | Months 1–2 | Identify control gaps, author policies, select compliance platform |
| Remediation | Months 2–3 | Implement missing controls, configure automated evidence collection |
| Observation Period | Months 3–6 | Minimum 3-month window where controls must operate effectively |
| Auditor Fieldwork | Months 6–7 | Independent auditor reviews evidence, interviews team |
| Report Issuance | Month 7–8 | Final SOC 2 Type II report delivered |
Cloudflare Carve-Out
ThornGuard runs entirely on Cloudflare’s infrastructure:
- Cloudflare Workers — compute
- D1 — structured data (audit logs, settings, OAuth tokens)
- KV — caching (license validation, baselines)
- Durable Objects — stateful processing (rate limiting, anomaly detection)
- Queues — async webhook delivery
Cloudflare maintains its own SOC 2 Type II report. Using the AICPA carve-out method, ThornGuard’s audit can reference Cloudflare’s report for infrastructure-level controls, significantly reducing the scope to:
- Application-layer access controls (license auth, team tokens, OAuth)
- Data handling practices (PII redaction, audit retention, GDPR purge)
- Change management (feature flags, migration-based schema changes)
- Monitoring and incident response (anomaly detection, webhook alerting)
This carve-out approach is standard practice for cloud-native SaaS products and reduces both audit cost and timeline.
Current Controls Mapping
ThornGuard already implements controls that map to SOC 2 Security criteria:
| SOC 2 Criterion | Description | ThornGuard Control |
|---|
| CC6.1 | Logical access security | License key authentication, team tokens with RBAC, OAuth 2.1 with PKCE |
| CC6.2 | Encryption of data | HTTPS-only transport enforcement, AES-256-GCM encryption of stored tokens |
| CC6.3 | Role-based access | Owner/admin/viewer roles, approval workflows for sensitive operations |
| CC6.6 | Boundary protection | SSRF blocking, IP whitelisting, origin validation, domain blocklists |
| CC6.7 | Data classification | PII/secret redaction (10+ pattern types), custom redaction rules, taint-based data flow labels |
| CC7.1 | Monitoring | Structured D1 audit logs with correlation IDs, webhook alerting integrations |
| CC7.2 | Incident detection | Behavioral anomaly detection (EWMA, drift, sequence analysis), tool poisoning alerts |
| CC7.3 | Incident response | Real-time webhook notifications, audit log export (CSV), GDPR purge capability |
| CC8.1 | Change management | Feature flags for phased rollout, migration-based D1 schema changes |
Gaps identified for remediation include: formal incident response procedures, documented change approval workflows, vulnerability management program, and business continuity planning.
| Factor | Vanta | Sprinto |
|---|
| Annual cost | ~$20–30K | ~$15–25K |
| Cloudflare integration | Mature — Workers, D1, KV supported | Growing — API-based collection |
| Automated evidence | Continuous monitoring + screenshots | Policy-driven collection |
| Auditor network | Large partner network | Smaller but growing |
| Time to readiness | ~3 months | ~2–3 months |
Estimated Costs
| Item | Cost |
|---|
| Compliance platform (year 1) | $15–30K |
| Independent auditor fees | $10–20K |
| Total year 1 | $25–50K |
| Ongoing annual | $15–25K |
Next Steps
- Select compliance platform and begin gap analysis
- Author formal security policies (access control, incident response, change management)
- Configure automated evidence collection for existing ThornGuard controls
- Begin the observation period
- Engage independent auditor for fieldwork
If SOC 2 attestation is a requirement for your organization’s procurement process, contact us to discuss timeline and priorities. 
