Legal · SOC 2

SOC 2 and security

Where Known stands on SOC 2, the controls in place today, and how to get the current report.

legal · soc2In effect
  • effective2026-09-16Dated
  • operatorUnknown, operating KnownParty
  • questionshello@known.infoContact

  1. 01Where we stand

    Known does not yet hold a SOC 2 report. We are preparing for a SOC 2 Type I audit and will publish the report on this page when it is issued, followed by a Type II. Until then this page lists the controls in place today so a security review can begin before the auditor's letter exists.

  2. 02Controls in place

    • One login per person, handled by a dedicated identity provider with multi-factor authentication available. We never hold passwords.
    • Organizations are isolated: a person reaches only the organizations they are a member of, with the role their admins set, and every request is checked against that.
    • Agents act only through a person’s session and never hold credentials of their own. Every write names the person and the agent, so the record is attributable end to end.
    • Data is encrypted in transit. Backups are taken nightly, encrypted, and held separately from production.
    • Access to production systems is limited to the people who operate the service, uses individual credentials, and is logged.
    • Every page keeps every revision; nothing rewrites history. Deletion is by an organization’s admin and completes within thirty days.
    • Model providers receive content only to produce the result asked for, under terms that forbid training on it.
    • Connections use only the access an admin granted and can be revoked at any time.

  3. 03What is planned

    • A SOC 2 Type I audit, then Type II over a twelve-month observation period.
    • Single sign-on, audit log export, and data boundary controls on the Business plan, each released as it is built rather than promised in advance.
    • A public status page and a security disclosure process, published here when they exist.

  4. 04Reporting a security issue

    If you find a vulnerability in Known, write to hello@known.info with “Security” in the subject. Tell us what you found and how to reproduce it, and give us a reasonable time to fix it before disclosing it. We acknowledge reports within two business days and tell you when the issue is resolved.

  5. 05Getting the current status

    For a security questionnaire, the current state of the audit, or a conversation with the people who run the service, write to hello@known.info. Business agreements include a security review as part of the conversation.