SOC 2 readiness

GEO Platform has been designed for SOC 2 requirements from day one (Security, Availability, Confidentiality). Below is an overview of the mechanisms in place.

Certification status

The architecture and processes align with SOC 2 requirements, but we do not yet hold a formal certificate. The certification path (Type I → Type II) is planned and can be started as part of an Enterprise engagement. We don't claim compliance we can't demonstrate.

What's implemented

• Complete audit trail — every data-modifying operation by an authenticated user is recorded automatically (who, what, when, from where), and operations on sensitive resources additionally include before/after values. Coverage doesn't depend on a developer remembering to log.
• Access control — system roles, tenant + workspace isolation on every request, and in Enterprise: MFA (TOTP), SSO (OIDC / SAML 2.0), SCIM 2.0 (automated account lifecycle from your IdP) and custom roles (least privilege).
• Encryption — TLS in transit; integration credentials and tokens encrypted at the database level, with key rotation in place.
• Sessions and tokens — JWT in HttpOnly; Secure; SameSite=Strict cookies + CSRF protection.
• Backups and DR — full + incremental backups + continuous change archiving (PITR), with recurring restore tests (a backup without a tested restore is no backup). Targets: RPO ≤ 1 h, RTO ≤ 4 h.
• Operational privacy — personal data deletion/anonymization (DSAR), configurable per-dataset retention, optional PII redaction in queries to external AI models.
• Monitoring — metrics, logs, error tracking (no PII), readiness healthchecks.

Due-diligence document

For IT and security teams we provide a detailed technical overview during procurement (16 sections: stack, isolation, encryption, DR, GDPR, SDLC, known gaps with plans). See also Security and Privacy.