Pursuing SOC 2 Type I

Security you can verify, not just read about.

Founders trust CoFounder.AI with their plans, numbers and customers. This is how we protect that — and approved auditors, customers and investors can go further in our SOC 2 portal.

How access works

1
Request access
Tell us who you are and why. Our security team reviews every request.
2
Get approved
You’ll receive an email once your access is granted, with how long it lasts.
3
Sign in & review
Sign in with that email (Google, LinkedIn or an emailed link), accept the confidentiality terms, and you’re in.

Security posture

SOC 2

CoFounder.AI, Inc. is pursuing SOC 2 Type I. Our security program is documented, owned and continuously improving ahead of an independent examination.

Hosting

Runs on Google Cloud Platform behind Cloudflare (DNS, WAF, DDoS protection, TLS). Infrastructure is managed as code and access-controlled.

Encryption

TLS in transit everywhere and encryption at rest with Google-managed keys. Secrets live in Google Secret Manager, never in source.

Access control

Google / LinkedIn SSO with optional TOTP two-factor. Administrative access is least-privilege and limited to verified staff identities.

Tenant isolation

Each customer’s project data lives in an isolated PostgreSQL schema with a per-project agent runtime — no cross-tenant access.

Subprocessors

A maintained register of subprocessors — cloud, AI, communications, billing — with the data each one processes, available in the portal.

Inside the SOC 2 portal

Not a folder of PDFs. The portal is a live view of the registers our team operates from, so what you review is what we run.

Policies & system description
Every policy with its version history and formal approval record.
Control register
Controls mapped to the Trust Services Criteria, with implementation and status.
Evidence
Dated, hashed artifacts — downloadable, with every retrieval logged.
Assessments
Penetration tests and reviews, with findings tracked to validated fixes.
Compliance calendar
Recurring obligations from our policies and the proof each one happened.
AI compliance assistant
Ask in chat or by voice; answers cite the documents and registers they used.

Request access

Access is personal and time-limited, granted to a specific email address. Materials are confidential and provided for security due diligence only; every view, search and download is logged.