SOC 2 not started · self-assessed control mapping only

Trust

Procurement evidence pack

SOC 2: not started. No report of any type exists, no auditor is engaged, no engagement letter is signed, no penetration test exists. A self-assessed control mapping (CSA CAIQ v4) is available under NDA. The procurement evidence below (CSA CAIQ v4, sub-processor list with compliance posture, DPA template) is available under our standard mutual NDA so vendor intake can proceed on what actually exists.

Honesty statement

Per CLAUDE.md §8 hard constraint #2, OilFlow does not claim SOC 2 Type II until the audit is complete and the report exists. Today, OilFlow operates against the SOC 2 Trust Services Criteria (security, availability, confidentiality), has implemented the controls that map to those criteria, and self-attests via CSA CAIQ v4 + SIG Lite. The Type 2 audit has not begun, no auditor is engaged, no engagement letter is signed, and no gap analysis has been performed. We will publish an observation window and a report date when a letter is signed, and update this page the day the report countersigns.

Attestation status

SOC 2 (any type)None. Self-assessed control mapping only
SOC 2 Type 2Not started · no auditor engaged
Type 2 reportNo date, set once a letter is signed
CSA CAIQ v4Self-attested · on request
Pen testNot scheduled
Sub-processor notice30-day advance

Public trust surfaces (no NDA): /trust · /trust/transparency

Mutual NDA: short form

The materials behind this page are pre-release procurement evidence: a CSA CAIQ v4 self-assessment, the sub-processor list, and our DPA template. SOC 2: not started. No report of any type exists, no auditor is engaged, no engagement letter is signed, no penetration test exists. A self-assessed control mapping (CSA CAIQ v4) is available under NDA. We make them available to prospective customer compliance + risk teams under our standard mutual NDA so vendor intake can proceed on what actually exists.

  • You will not redistribute these artifacts outside your organization’s compliance + procurement + legal teams.
  • You will treat the CAIQ self-assessment, sub-processor list, and DPA template as confidential.
  • Full NDA terms apply per the executed pilot/MSA, or, pre-contract, our standard form at /dpa.
  • This acceptance is logged with your email + organization for our records.

Acceptance is stored in a first-party cookie for 30 days. No third-party tracking. Questions: [email protected].