No badges we haven’t earned. Here’s what we’re actively pursuing, our audit timeline, and what you can verify today. Updated as things change.
Building a security program in public is uncomfortable. It’s also the honest way to do it. The entire program runs on vCISO Lite — same platform we sell, same evidence pipeline our customers will use.
In progress — pursuing
Working toward our SOC 2 Type I report using vCISO Lite itself. Policies, evidence collection, and gap remediation all run on the same platform we sell. When the report lands, it'll be linked here with the auditor's name on it.
In progress — pursuing
Completing the Consensus Assessments Initiative Questionnaire via vCISO Lite. CAIQ is the same questionnaire enterprise procurement teams send to vendors — answering it ourselves before our customers have to ask.
Our journey to multi-framework compliance, including expected milestones.
Began running our own security program on vCISO Lite. Initial policy library generated; baseline gap analysis complete.
Implemented and operationalized controls against SOC 2 trust service criteria. Evidence collection pipeline live.
Auditor selected, scoping locked, evidence packages assembled. CAIQ responses in progress in parallel.
Expected audit fieldwork window. Bridge letter cadence and continuous-monitoring evidence flowing from vCISO Lite.
Target: signed SOC 2 Type I report published to this page with the auditor's name on it. CAIQ posted publicly.
Begin 12-month Type II observation period using the same evidence pipeline. Report expected late 2027 / early 2028.
For vendor security assessments or procurement reviews, email security@vcisolite.com. We typically respond within one business day.
We can share work-in-progress CAIQ responses on request. Full CAIQ posted publicly when complete.
Standard DPA with EU Standard Contractual Clauses, available on request.
Executive summary from our most recent third-party pentest, under NDA.
Cyber liability and E&O insurance certificates available on request.
We understand vendor security assessments. The SOC 2 Type I report is in progress; in the meantime, tell us what your procurement team needs and we’ll respond with the actual artifacts available today.