SOC 2 readiness, not a letter we printed ourselves
The product ships the control pack an auditor samples: SSO, MFA, IP allowlists, SCIM, hashed device tokens, audit export. A Type II report is still issued by an independent firm.
SSO that actually signs you in
Google and Microsoft through Neon Auth. Require SSO on an email domain and password login is refused. New users on that domain join the mapped organization.
MFA and session policy
Organization policy can demand an MFA claim and expire sessions. IP allowlists cannot lock out the operator who is enabling them.
SCIM 2.0
Users and groups, tokens hashed at rest. Okta and Entra provision into the same membership table the console uses.
Audit trail
Every write records the operator, the change and the source address. Export as CSV for an access review.
Encryption
TLS on console, API and player. The Android player refuses cleartext. Postgres and object storage sit on Neon, encrypted at rest.
No secrets on the wall
Players poll with a device token hashed at rest. Third-party keys stay on the server. A stolen box cannot log into the console.
What is in product today
CC6 logical access: Neon Auth RS256 JWTs, scoped API keys, device tokens.
CC5 control activities: MFA, SSO domain, IP allowlist, session lifetime.
CC4 monitoring: heartbeats, Prometheus metrics, webhook delivery state.
A1 availability: last-good manifest cache; Neon PITR for the database.
C1 confidentiality: folder ACL, recycle bin, no vendor keys on devices.
PI1 privacy: anonymous audience aggregates with a retention job.
Subprocessors: Neon, Stripe, Firebase Hosting. Listed in the console trust pack.
We do not claim a SOC 2 Type II letter until an auditor issues one.
Questionnaire or pentest request? Talk to us.
Walk this with your IT team
The same pack is in Access → SOC 2 readiness after you sign in.