SOC 2 readiness — in progress

Horizons is pre-SOC 2. We are running our Type I readiness assessment with a Type II observation window to follow. The controls we ship against today already align to the SOC 2 trust-services criteria — security, availability, confidentiality, privacy, and processing integrity.

Internal trust documentation set is complete (security posture one-pager, methodology document, vendor questionnaire boilerplate in flight) and maps directly onto the SOC 2 trust-services criteria.
Internal OWASP Top-10 review completed; rate limiting + CSRF + CSP + audit logging + 2FA all in production. The independent pen test is part of this same workstream, not yet done.
Append-only audit log records every mutation to a user's financial entities with actor, action, entity type, and before/after snapshots.
Incident-response runbook is the next planned addition to the trust folder; security-disclosure mailbox is live at the address on /security.

Honest note

We follow the same rule our /security page does: we do not claim certifications we do not hold. This page is updated when the assessment advances. If you're a buyer and need a specific point-in-time attestation before the SOC 2 process completes, we're happy to walk you through the trust-folder evidence under NDA — reach out via /contact.

More on how we protect your data, in plain terms:

Full security overview