Trust, stated plainly.

TruOps holds a SOC 2 Type II report covering all five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. The report is available to customers and prospects under NDA. We do not publish a redacted PDF on this page; a security review is how you get the real package.

A serious buyer does not want a marketing page. They want a packet and a walkthrough. Request a security review (or email hello@truops.ai) and we send, under NDA:

• The current SOC 2 Type II report.
• A current subprocessor list and a description of hosting. We do not post those lists here because they change; the NDA packet is the source of truth.
• A data-processing addendum discussion, including how customer content is used (it is not used to train foundation models).
• Architecture enough to evaluate tenant isolation, encryption in transit and at rest, access control, and logging — without a public diagram that becomes stale.
• Answers to your SIG, CAIQ, or custom security questionnaire, pre-filled from our own program where we can, cited, with gaps left for a person.

• Tenant isolation. Every environment, whether an enterprise, an MSSP client, or a portfolio company, has its own data, evidence, and access boundary. Data does not cross tenants. Context switches are explicit and logged.
• Fine-grained access. Role- and attribute-based permissions apply to people and AI agents alike. TruPilot acts with scoped rights, not as an unbounded admin.
• Read-only integrations. Connectors observe Azure, AWS, Google Cloud, Entra ID, Okta, Intune, Defender, CrowdStrike, Tenable, Qualys, GitHub, and Azure DevOps with least-privilege scopes, revocable at any time. They do not change your configuration.
• One audit log. Every action, human or agent, is recorded. Completed assessment results are saved as of their date.
• AI data use. Your documents, telemetry, and corrections improve your own tenant. They are not used to train foundation models or shared across tenants. See Commitments.

Security pages fail when they invent a region, a pentest firm, or a certification they do not hold. If it is not below, ask us under NDA rather than assuming it.

If TruOps will draft assessments in your environment, treat the AI the way you would treat a privileged contractor.

1. ProvenanceEvery drafted answer must show its source and confidence. If it cannot, it must stay blank.
2. Separation of dutiesWhatever produced a value cannot approve it. Watch an assessment complete in a demo.
3. LoggingAccept, reject, and override must land in the same audit log as human work.
4. ScopeAgents and connectors must run with least privilege. Connectors are read-only.
5. DecayStatus must drop when evidence goes stale. A permanently green control is a dashboard, not CCM.

The test is written up as Agents without a human gate.

How TruOps' AI behaves — citing sources, never approving its own work, confidence routing, least-privilege agents, asking when unsure, one audit log — is published on our Commitments page. That page is the product rulebook. This page is the security review.