Compliance

Certifications, audit reports, and the SOC 2 program timeline.

Active certifications

None. KONDWIT holds no SOC 2 report, no ISO certification, and no other third-party security attestation. A SOC 2 Type I engagement is underway — not yet a report, and not a certification — see the timeline below for exactly where it stands.

SOC 2 program

KONDWIT is pursuing SOC 2 covering Security, Availability, and Confidentiality Trust Service Criteria, beginning with a Type I audit and continuing toward Type II. The phases below are the plan; the status against each is stated as of 13 September 2026.

• Phase A — Readiness (substantially complete): compliance platform onboarding, policy package, control gap closure, internal readiness review. A written policy package and control matrix exist and a manual gap assessment against the live environment was completed on 11 August 2026. Thoropass is now onboarded as the compliance platform. Still outstanding: the policy package has not been formally approved (the policies carry DRAFT status), and no external readiness review was performed before the audit began.
• Phase B — Type I audit (in progress): point-in-time audit; report to be published to this page (NDA-gated download). KONDWIT engaged Thoropass on 6 September 2026 for the SOC 2 Type I audit, and that engagement is underway. No report has been issued yet, and KONDWIT holds no SOC 2 certification.
• Phase C — Type II window (not started): 6 months of continuous evidence collection, following the Type I report.
• Phase D — Type II audit (not started): auditor reviews the window; report published.

We have not committed to a publication date for the Type I report or to dates for Phases C and D, and we will not publish a date we cannot stand behind. If a completed SOC 2 report is a gating requirement for your procurement today, KONDWIT does not meet it yet: the Type I audit is in progress and no report exists.

Future certifications

• ISO 27001: roadmap; complementary to SOC 2. No work started.
• HIPAA: engage if a customer requires. No work started.

Customer questionnaires

Pre-populated SIG and CAIQ questionnaire responses have not been produced yet — there is no completed questionnaire to release, under NDA or otherwise. If you need either, email security@kondwit.com and we will complete your copy directly against this Trust Center.