Privacy Policy

1. What we collect

You give us

• Identity and contact: name, work email, company name, role
• Company shape: headcount, industry, funding stage, location
• Form answers: your responses to the intake topics covering your stack, security posture, deadlines, budget, and current state
• Supporting documents (optional): if you choose to email us an org chart, vendor list, architecture sketch, or other documents to improve your package, we'll use them for generation only. We encourage you to redact personal names before sending.
• Payment info: processed by Stripe. We receive a transaction record (amount, last 4 digits of card, card brand, billing ZIP). We do not see, store, or have access to your full card number.

We collect automatically

• IP address, user-agent string, browser language
• Timestamps for form-start, form-complete, payment, package-delivered
• Pages viewed (basic analytics, no cross-site tracking)
• Cookies used to maintain your form session

We do not use third-party advertising trackers on the soc2zip pages.

We do not collect

• Government IDs, SSNs, biometric data
• Personal information about your customers, employees, or vendors beyond what you choose to include in your form answers or email us
• Health information, financial account numbers, or any data that would invoke HIPAA, GLBA, or similar specialized regimes

If your business handles such data and you email us documents containing it, please redact first.

2. How we use what we collect

1. Prepare your package. Form answers and any supporting documents you email us pass through our document-processing workflow to produce your draft policies, evidence index, CAIQ Lite, and auditor introductions.
2. Deliver your package. Email your package to you as an attachment.
3. Provide support. Respond to questions, fix issues, process refunds.
4. Match auditors. The matcher returns three auditor candidates inside your package. Your identity is not shared with those firms unless you explicitly opt in by contacting them directly.
5. Improve our templates and quality checks. We hash and de-identify submissions for our regression-test set. We do not use your inputs to train third-party models.
6. Bill you and pay our taxes. Standard accounting use.
7. Detect fraud and abuse. IP and user-agent help us spot duplicate submissions and payment fraud.
8. Communicate. Transactional emails (delivery, refund, support): always. Marketing emails: only if you opted in at checkout, and you can unsubscribe any time.

3. Automated processing

We use automated document-processing tools, including generative AI, to turn your inputs into a draft package for human review.

• Your form answers and any supporting document contents may be sent to a contracted processing provider solely to prepare your package.
• We use business-grade provider terms that restrict use of API inputs and do not permit your inputs to be used to train public models.
• A human reviews the package before delivery, but you remain responsible for confirming every statement against your actual controls.
• Our regression-test set uses hashed, de-identified versions only.

If you do not want your inputs processed by a contracted generative-AI provider, do not purchase soc2zip.

4. Sharing: who sees what

Subprocessors

Auditors

The auditor introductions in your package include three matched firms. We do not share your identity with those firms unless and until you reply to the email or otherwise contact them.

Legal compulsion, fraud, sale of business

We may share your data when required by valid legal process, to prevent fraud, or in connection with a sale of the business. In a sale scenario, we'll notify you by email at least 30 days before the transfer and let you delete your data first.

We do not sell your data

Period. No exceptions.

5. Your rights

You can ask us to access, correct, delete, or port your data. If you are in the EU, UK, or California, additional rights under GDPR, UK GDPR, or CCPA apply. We honor those rights for all customers, regardless of location.

To exercise any of these: email hello@soc2auditors.org from the email address you used at checkout. We respond within 30 days; usually within 5 business days.

7. Security

See Document Retention Policy under "Security posture." Short version: encrypted at rest, encrypted in transit, MFA on production systems. If we discover a security incident affecting your data, we will notify you by email within 72 hours of confirming the incident.

10. Contact

Privacy questions / data requests: hello@soc2auditors.org

Operating entity: soc2.zip, operated by the team behind soc2auditors.org, United States