Audit reports
Where Draftiro stands on independent security audits — stated plainly, for your procurement review.
SOC 2 Type II
Status: not audited — no SOC 2 report held
We'll be direct: Draftiro is not SOC 2 certified, has not engaged an auditor, and holds no SOC 2 report. We have a written SOC 2 Type II readiness plan and are building the controls it covers (firm-scoped access controls, encryption, MFA, access control, audit logging), but no observation period or independent audit has begun. We won't name an auditor, a target date, or call an audit "underway" until an engagement letter is signed, and we won't represent the report as complete until one issues.
Notify me when this progresses →What we can share today (under NDA)
While there is no SOC 2 report yet, we can support a vendor-risk review now: our security & trust overview, a pre-filled CAIQ / SIG-Lite security questionnaire, an architecture walkthrough, and our subprocessor list. A data processing agreement is being finalized — contact us if your firm needs one. Ask and we'll send the package.
Request our security package