---
title: "Trust Center | SOON"
description: "Security controls, trust documents, subprocessors, and compliance certification for the SOON Platform."
url: "https://soon.com.au/trust"
---

Trust Center

# Security is foundational to everything we build.

SOON is built with enterprise-grade security, Cloudflare edge protection, data isolation, and privacy controls from day one. We are prioritising being SOC 2, ISO 27001, and ISO 42001 standards compliant and are actively pursuing formal certification.

Formal certification for SOC 2 Type II, ISO 27001, and ISO 42001 is underway.

[Privacy Policy](https://soon.com.au/privacy)[Terms of Service](https://soon.com.au/terms)

Overview

## Control coverage

Production controls enforced across the SOON Platform, portal APIs, and SOON OS plugins.

| Scope | Privacy | Terms | Subprocessors | Edge Protection | Authentication | Data Isolation | Audit Trail | API Controls | Human Review | Monitoring | SOC 2 Type II | ISO 27001 | ISO 42001 |
| --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- | --- |
| ### SOON Platform Core application experience and workspace intelligence. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | - | ✓ | In process | In process | In process |
| ### SOON Portal APIs Scoped APIs for integrations, automations, and controlled writes. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | In process | In process | In process |
| ### SOON OS Plugins Plugins running on SOON OS and using SOON services. Plugin-specific subprocessors and disclosures are published alongside each plugin release. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | ✓ | In process | In process | In process |
| ### SOON MCP and OAuth Client-facing connector authentication and resource access. Public MCP and OAuth domains are protected at the Cloudflare edge. | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | ✓ | - | - | ✓ | In process | In process | In process |

Trust Documents

## Core trust documents

Published policies, agreements, and review paths for security and procurement teams.

[Privacy Policy Full data handling and privacy practices for the SOON Platform. Open](https://soon.com.au/privacy)

[Terms of Service Service terms and conditions governing use of the SOON Platform. Open](https://soon.com.au/terms)

[Subprocessor List Complete register of third-party data processors. Open](https://soon.com.au/trust#subprocessors)

[DPA Requests Request our standard Data Processing Addendum for GDPR and regulatory review. Open](mailto:legal@soonfutures.com)

[Trust Questions Security questionnaires, vendor assessments, and procurement inquiries. Open](mailto:legal@soonfutures.com)

Roadmap

## Security and certification roadmap

Completed hardening milestones, active compliance work, and certification timelines.

March 2026Completed

### Security hardening across platform APIs

Deployed scoped graph reads, durable audit introspection, admin-only API key infrastructure, and hardened portal API error handling across all active SOON services.

March 2026In process

### Human-in-the-loop write controls

Enforcing dry-run flows, idempotency, confirmation gates, and mandatory operator review before any sensitive write action is applied across the SOON Platform.

April 2026In process

### Compliance evidence and policy pack

Assembling security questionnaires, vendor records, policy documentation, and control evidence to formalise existing practices into auditable compliance packs.

May 2026Completed

### Cloudflare edge protection

Cloudflare protects the public site and client-facing MCP/OAuth endpoints with edge security, branded Worker domains, and controlled service entry points.

Target Q3 2026In process

### SOC 2 Type II

Controls already operating to SOC 2 standards. Engaging auditors for formal Type II attestation.

Target Q4 2026In process

### ISO 27001

Information security management system in place. Progressing toward formal ISO 27001 certification.

Target Q1 2027In process

### ISO 42001

AI governance framework operational. Building formal evidence base for ISO 42001 certification of responsible AI management across SOON.

Certification timelines reflect current planning and may be brought forward as work progresses.

Subprocessors

## Subprocessor register

All third-party vendors that process data on behalf of the SOON Platform.

| Provider | Role | Scope |
| --- | --- | --- |
| [Supabase](https://supabase.com/privacy) | Authentication and application data infrastructure | SOON Platform and portal APIs |
| [Neo4j AuraDB](https://neo4j.com/privacy) | Data infrastructure | SOON Platform |
| [Railway](https://railway.com/legal/privacy) | Application hosting | SOON Platform |
| [Cloudflare](https://www.cloudflare.com/privacypolicy/) | Edge security and traffic protection | Public site, MCP, and OAuth endpoints |
| [Stripe](https://stripe.com/privacy) | Billing and subscription management | SOON Platform |
| [Anthropic](https://www.anthropic.com/privacy) | AI provider | Configured SOON workflows |
| [OpenAI](https://openai.com/privacy) | AI provider | Configured SOON workflows |
| [Google](https://policies.google.com/privacy) | AI provider | Configured SOON workflows |
| [xAI](https://x.ai/legal/privacy-policy) | AI provider | Configured SOON workflows |
| [Exa](https://exa.ai/privacy) | Search and retrieval provider | SOON Platform |
| [LangSmith](https://www.langchain.com/privacy-policy) | Observability provider | SOON Platform |

FAQ

## Frequently asked questions

Common questions from security, legal, and procurement teams.

###

###

###

###

###

###

###

[View this page on SOON](https://soon.com.au/trust)