Security hardening across platform APIs
Deployed scoped graph reads, durable audit introspection, admin-only API key infrastructure, and hardened portal API error handling across all active SOON services.
Trust Center
Security is foundational to everything we build.
SOON is built with enterprise-grade security, Cloudflare edge protection, data isolation, and privacy controls from day one. We are prioritising being SOC 2, ISO 27001, and ISO 42001 standards compliant and are actively pursuing formal certification.
Formal certification for SOC 2 Type II, ISO 27001, and ISO 42001 is underway.
Overview
Control coverage
Production controls enforced across the SOON Platform, portal APIs, and SOON OS plugins.
| Scope | Privacy | Terms | Subprocessors | Edge Protection | Authentication | Data Isolation | Audit Trail | API Controls | Human Review | Monitoring | SOC 2 Type II | ISO 27001 | ISO 42001 |
|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
SOON PlatformCore application experience and workspace intelligence. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | - | ✓ | In process | In process | In process |
SOON Portal APIsScoped APIs for integrations, automations, and controlled writes. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | In process | In process | In process |
SOON OS PluginsPlugins running on SOON OS and using SOON services. Plugin-specific subprocessors and disclosures are published alongside each plugin release. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | ✓ | In process | In process | In process |
SOON MCP and OAuthClient-facing connector authentication and resource access. Public MCP and OAuth domains are protected at the Cloudflare edge. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | - | ✓ | In process | In process | In process |
Trust Documents
Core trust documents
Published policies, agreements, and review paths for security and procurement teams.
Privacy Policy
Full data handling and privacy practices for the SOON Platform.
Terms of Service
Service terms and conditions governing use of the SOON Platform.
Subprocessor List
Complete register of third-party data processors.
DPA Requests
Request our standard Data Processing Addendum for GDPR and regulatory review.
Trust Questions
Security questionnaires, vendor assessments, and procurement inquiries.
Roadmap
Security and certification roadmap
Completed hardening milestones, active compliance work, and certification timelines.
Human-in-the-loop write controls
Enforcing dry-run flows, idempotency, confirmation gates, and mandatory operator review before any sensitive write action is applied across the SOON Platform.
Compliance evidence and policy pack
Assembling security questionnaires, vendor records, policy documentation, and control evidence to formalise existing practices into auditable compliance packs.
Cloudflare edge protection
Cloudflare protects the public site and client-facing MCP/OAuth endpoints with edge security, branded Worker domains, and controlled service entry points.
SOC 2 Type II
Controls already operating to SOC 2 standards. Engaging auditors for formal Type II attestation.
ISO 27001
Information security management system in place. Progressing toward formal ISO 27001 certification.
ISO 42001
AI governance framework operational. Building formal evidence base for ISO 42001 certification of responsible AI management across SOON.
Certification timelines reflect current planning and may be brought forward as work progresses.
Subprocessors
Subprocessor register
All third-party vendors that process data on behalf of the SOON Platform.
| Provider | Role | Scope |
|---|---|---|
| Supabase | Authentication and application data infrastructure | SOON Platform and portal APIs |
| Neo4j AuraDB | Data infrastructure | SOON Platform |
| Railway | Application hosting | SOON Platform |
| Cloudflare | Edge security and traffic protection | Public site, MCP, and OAuth endpoints |
| Stripe | Billing and subscription management | SOON Platform |
| Anthropic | AI provider | Configured SOON workflows |
| OpenAI | AI provider | Configured SOON workflows |
| AI provider | Configured SOON workflows | |
| xAI | AI provider | Configured SOON workflows |
| Exa | Search and retrieval provider | SOON Platform |
| LangSmith | Observability provider | SOON Platform |
FAQ
Frequently asked questions
Common questions from security, legal, and procurement teams.