SOC 2 posture

Where the practice stands

Basis

Self-assessed against the SOC 2 Trust Services Criteria (2017) and mapped to ISO/IEC 27001 Annex A. No auditor has examined the controls.

Operating procedures

12: 10 operating, 2 in progress.

Policy set

22 controlled documents, signed by the director on 31 August 2026 and reviewed annually under a document-control procedure.

Evidence

First quarterly cycle run in August 2026: access review, deletion drill, incident-response tabletop, endpoint verification, restore drill, patch triage. First internal audit 28 August 2026.

Independent assurance

None. No SOC 2 report, no ISO 27001 certificate, no external penetration test.

Scope

Phase Transitions (Pty) Ltd and both platforms it operates: the accounting analytics platform and WealthVault.

Operating procedures

Each procedure is written as one commitment in standard control language, with the SOC 2 criteria and Annex A controls it is built against. A procedure is marked operating only when it is true and evidenced. Each has a written test, mechanical where possible.

1. SOP-01

   Client data handling and least-privilege access

   operating

   Client production data lives only in managed cloud infrastructure under least-privilege access: it never lands at rest on personal or developer devices, and every access is logged.

   SOC 2 c2.1, cc5.2, cc6.1, ddq.data-residency, ddq.tenant-isolation-multitenancy · ISO 27001 A.5.14, A.8.2, A.8.12

2. SOP-02

   Secrets management

   in progress

   Secrets are held in a managed secrets manager (1Password) and never in source control. Production workloads receive them by runtime injection through scoped service accounts. Development uses registered per-project secret files whose values are passed to processes without being displayed, and AI coding agents hold no access to the secrets manager. Secrets are rotated on a schedule and on compromise.

   SOC 2 cc6.1, ddq.api-access-control-rbac, ddq.encryption-in-transit-at-rest · ISO 27001 A.5.17, A.8.24

3. SOP-03

   Development, test / production separation

   operating

   Development and testing run against synthetic or de-identified data; production data is never used in development.

   SOC 2 cc3.4, cc8.1 · ISO 27001 A.8.31, A.8.33

4. SOP-04

   Tenant isolation

   operating

   Each client's data is reachable only by that client's scoped identity; cross-client access is denied, and this is proven by an automated test.

   SOC 2 cc6.1, ddq.tenant-isolation-multitenancy · ISO 27001 A.5.15, A.8.22

5. SOP-05

   Logging and monitoring

   operating

   Security-relevant events and AI prompt/output access are logged, and the system is monitored for failures and anomalies.

   SOC 2 cc7.2, cc7.3, ddq.prompt-output-logging-audit · ISO 27001 A.8.15, A.8.16

6. SOP-06

   Encryption in transit and at rest

   operating

   Data is encrypted in transit and at rest by our managed infrastructure providers.

   SOC 2 ddq.encryption-in-transit-at-rest · ISO 27001 A.8.24

7. SOP-07

   Access provisioning and deprovisioning

   operating

   Access is granted on a need basis, reviewed periodically, and removed promptly when no longer required.

   SOC 2 cc6.2, cc6.3 · ISO 27001 A.5.16, A.5.18

8. SOP-08

   Backup and recovery

   operating

   Backups are taken, restoration is drilled, and recovery objectives (RTO/RPO) are measured rather than assumed.

   SOC 2 ddq.backup-disaster-recovery · ISO 27001 A.5.30, A.8.13

9. SOP-09

   Data retention and deletion

   operating

   Client data is retained and deleted according to a defined, verifiable policy.

   SOC 2 cc2.5, ddq.data-retention-deletion · ISO 27001 A.5.14, A.8.10

10. SOP-10

    Incident response and breach reporting

    operating

    Incidents are detected, contained per a runbook, and reported within the applicable regulatory clocks.

    SOC 2 cc7.3, p7.1 · ISO 27001 A.5.24, A.5.26, A.5.28

11. SOP-11

    Processing integrity

    operating

    Data transformations are predefined, controlled and verified, and the AI reads finished figures: it never authors them.

    SOC 2 pi1.1, pi1.4, pi3.2 · ISO 27001 A.8.29

12. SOP-12

    Change management

    in progress

    Changes are reviewed, tested, and deployed through a controlled path with a known rollback.

    SOC 2 cc8.1 · ISO 27001 A.8.32

Criteria index

The same mapping read from the standard's side: each criterion cited above, and the procedures built against it. Items prefixed ddq are vendor due-diligence questions the practice tracks alongside the Trust Services Criteria.

Policies and procedures

Every document is numbered one-sentence statements, each with the record that evidences it. Documents are versioned, reviewed annually, and signed by the director; the controlled copy is the source in version control. The set was adopted at its current versions on 31 August 2026.

7 further platform documents describe WealthVault: its system and tokenisation overview, POPIA position, security-testing posture, sub-processor assurance, monitoring, patch process and patch SLA.

Evidence

Each procedure with a cadence has run at least once, with a dated record. The next run is diarised and a lapsed cadence shows red in the practice's daily operations digest.

For a vendor-onboarding review

If you are clearing Phase Transitions as a vendor, write to graham@phasetransitions.ai. The review pack is the signed policy set, the sub-processor and data-processing-agreement register, the SOC 2 and ISO 27001 control mapping, and the confirmation of insurance, shared under the review's confidentiality terms. Questionnaires such as SIG Lite are answered from the same registers.