SOC 2 Type II at Ciao

A SOC 2 Type I report describes controls as designed on a single day. A Type II report tests whether those controls actually operated over an audit period — which is the question your risk assessment is really asking. For a platform that generates, tests and deploys production software, operating effectiveness matters more than design intent: a change-management control that exists on paper but is skipped under deadline pressure is precisely what Type II auditing is built to surface.

Ciao provides SOC 2 Type II reports under NDA. The NDA step is standard for this document class and works in your favor: it means you receive the full report — scope, auditor testing, results — rather than a public summary trimmed for marketing.

There is a procedural benefit worth naming, too. Because the report is a standard artifact, your team can review Ciao with the same rubric it uses for any processor: no special AI exception, no bespoke assessment framework — the same document class, the same scoring, the same evidence bar.

The control families a SOC 2 review examines are visible in the product itself. Identity and access: SSO via SAML and OIDC, optional MFA and role-based access control. Change management: Guardrails detects risky changes, applies plain-English policies, records human review and leaves an audit trail behind every merge. Monitoring and operations: QA runs smoke gates before publish and production checks after, while Doctor — a read-only AI SRE — probes the live application, DNS and CDN.

This mapping is context, not a substitute for the report. The report itself is the authoritative statement of audit scope and results; treat any webpage summary, including this one, as an index to the real document.

Use the mapping the way you would use a site map: it tells reviewers where to look in the product when a control description in the report feels abstract. Reading the report with the product open turns audit language into observable behavior, which is the fastest route to justified confidence.

A Type II report covers its audit period; your risk does not stop at the period's end date. Two things bridge the gap. First, the security pack — available on request via the contact page — documents current architecture and data handling. Second, the controls themselves are part of the product, so an evaluation can watch them operate today rather than relying only on how they operated during the audited window.

If your vendor-risk process re-scores annually, the annual loop here is straightforward: request the current report, compare the scope statement against last year's, and re-run the live checks your team recorded during the first evaluation. Reviews get cheaper each cycle because the evidence trail is already established.