SOC 2 Type II for Your Rock
PetRock.cloud maintains an annual SOC 2 Type II attestation covering the Security, Availability, and Confidentiality Trust Services Criteria. This article describes our compliance posture, audit cadence, what is in scope, and how to obtain the report.
Audit cadence
We undergo a SOC 2 Type II examination every 12 months, with the audit window covering the preceding 12-month period. The most recent report covers April 1, 2025 through March 31, 2026 and was issued by an independent CPA firm in April 2026.
Between audits, we engage in continuous monitoring and bridge letters are available on request to cover the gap between report issuance and the start of the next audit window.
Scope of attestation
The following systems are in scope:
- The PetRock.cloud production application (api.petrock.cloud, app.petrock.cloud)
- Customer-facing dashboard and admin console
- Rock provisioning and lifecycle management infrastructure
- Webhook delivery infrastructure
- Audit logging pipeline
- Customer support tooling
- Internal access management for the systems above
The following are not in scope:
- Sandbox environment (sandbox-api.petrock.cloud)
- Public marketing site (petrock.cloud)
- Status page (status.petrock.cloud)
- Beta and preview features (clearly labeled as such in the dashboard)
Trust Services Criteria covered
| Criterion | Included | Notes |
|---|---|---|
| Security (Common Criteria) | Yes | Required baseline |
| Availability | Yes | Backed by tier-specific SLAs |
| Processing Integrity | No | Excluded; rocks do not process inputs |
| Confidentiality | Yes | Customer data and metadata |
| Privacy | No | Covered separately under GDPR |
Note: Processing Integrity is excluded because rocks do not perform processing. There is no input-to-output transformation to attest to. Customers requiring Processing Integrity coverage should evaluate whether the criterion is meaningful for an inert resource.
Controls highlights
Selected controls included in the attestation:
- Mandatory MFA for all employee access to production
- Quarterly access reviews
- Annual penetration testing by an independent third party
- 24/7 on-call rotation with documented incident response runbooks
- Encryption in transit (TLS 1.2+) and at rest (AES-256)
- Customer data segregation by workspace ID enforced at the database query layer
- Vendor security review process for all subprocessors
Requesting the report
The SOC 2 Type II report is available under NDA to current and prospective customers.
- Navigate to Settings → Compliance → Reports.
- Click Request SOC 2 Report.
- The request goes to our compliance team and is fulfilled within 2 business days.
For prospective customers, contact trust@petrock.cloud with your company details.
Customer responsibilities
SOC 2 attestation covers PetRock.cloud's controls. Customers are responsible for:
- Configuring MFA for their own users (see MFA Setup)
- Rotating API tokens on appropriate cadence
- Restricting OAuth application access to required scopes
- Reviewing audit logs in the dashboard for suspicious activity
Subprocessors
A current list of subprocessors is published at petrock.cloud/legal/subprocessors. Material additions are announced 30 days in advance via email to workspace administrators.