We Achieved SOC 2 Compliance. Here's What That Actually Means

This month, we hit a milestone we've been working toward for a while: achieving SOC 2 Type II compliance. Here's what SOC 2 actually means, and why it matters to us beyond the badge for our website.

More Than Just "Trust Us"

When an applicant submits plans through your jurisdiction, they’re trusting you with work that represents real money and real time. Engineering drawings, architectural documents, proprietary design decisions - all of it moves through your review process and our systems every day. You take that obligation seriously, and so do we.

A SOC 2 Type II audit means an outside auditor reviewed how we actually operate over a period of time. It’s a formal review of our infrastructure, software, people, and data policies. Our SOC 2 audit was conducted by A-LIGN, a leading provider in cybersecurity compliance trusted by more than 4,000 global organizations. A-LIGN didn’t just look at what we say we do—they verified what we demonstrably do to:

• Control access to your sensitive data.

• Log and monitor all system activity.

• Safeguard the personal assets of our users and their constituents.

For government agencies managing public infrastructure data, that kind of external validation matters. Your IT department shouldn't have to take our word for it.

A Solid Foundation for AI

The timing of this is deliberate. We're actively building AI into the product — tools that help reviewers move faster, catch issues earlier, generate cleaner output. That work is accelerating. And as it does, we want the foundation underneath it to already be solid. How we store your data, who can access it, how it moves through our systems — we'd rather have all of that locked down and audited before we go further, not after.

We’re proud of this milestone because it reflects our continued commitment to compliance. It’s about giving you the confidence that the right safeguards are in place so you can focus on the work that builds your community.