Every Octus product now holds SOC 2 Type II. Yes, the AI too.

Nobody gets into security because they love audits. I didn’t. What I love is what a clean audit lets our clients skip.

Our full suite of products now holds SOC 2 Type II attestation. That includes Octus Intelligence, FinDox™, Sky Road® Galaxy, LevPro and the Octus AI platform. This year’s examination brought Octus Intelligence and Sky Road Galaxy into our core report, and the independent CPA firm noted no exceptions. LevPro has maintained its own SOC 2 Type II for more than three years.

What SOC 2 Type II means

SOC 2 is an attestation report. An independent CPA firm tests a company’s controls against criteria set by the AICPA and reports what it found. Type II means the auditor tested whether those controls actually worked over a sustained period, not just on a single day. Ours did, across security, availability and confidentiality.

Why it matters to you

For clients, this keeps growth simple. Add FinDox or turn on the Octus MCP Connector™ and the controls your risk team already cleared come with it. For prospects in procurement, a current Type II answers much of the security questionnaire before we ever get on a call. I’ve sat on both sides of that questionnaire for years. Anything that makes it shorter is good for everyone.

The AI is inside the audit

The AI is where the market tends to get vague, so I’ll be specific. CreditAI by Octus®, our Covenants AI capabilities and Direct Data Services, including the Octus MCP Connector, all sit inside the attestation. The auditor tested AI-specific controls, including prompt-injection defenses, AI change management and third-party model provider review. We don’t use client data to train or adapt third-party foundation models. Every AI query is checked against your existing entitlements, so the AI never sees more than you’re already allowed to see.

A company-wide effort

SOC 2 controls reach well beyond security and engineering, into teams across Octus. DevOps brought newly integrated products and recent acquisitions onto shared infrastructure. Supreet Kaur, our Senior Director of Cybersecurity, led the examination with the Security team and made sure every control was evidenced across the full period.

A clean SOC 2 is table stakes in credit. What makes ours worth writing about is what sits inside it, and for us that’s the whole platform, AI included.

The full report is available to clients and trialists under our confidentiality terms. Ask your Octus contact for a copy. To go deeper on how we govern AI, read our AI Framework page.