Security
Passu completes SOC 2 Type II examination
Schuyler Fried
·
·
4 min read
At a glance
An independent SOC 2 Type II examination of the Passu Platform was completed
The six-month review period lasted from February 1 through July 31, 2026
Controls were evaluated across Security, Availability, and Confidentiality
Passu has completed a SOC 2 Type II examination of the Passu Platform. Conducted by Thoropass Assurance, the examination covered the period from February 1 through July 31, 2026 and evaluated controls relevant to Security, Availability, and Confidentiality.
Independent assurance over time
Passu completed an independent SOC 2 Type II examination conducted in accordance with AICPA attestation standards. The independent service auditor concluded that the controls described in the report were suitably designed and operated effectively throughout the review period, in all material respects.
Scope of the examination
The report covers the Passu Platform and controls relevant to three AICPA Trust Services Categories: Security, Availability, and Confidentiality. The review period ran from February 1 through July 31, 2026.
According to the AICPA, SOC 2 reports provide detailed information and assurance about controls at a service organization that are relevant to the systems used to process customer data and the confidentiality and privacy of that information.
From control design to operating effectiveness
A SOC 2 Type I examination evaluates whether controls are suitably designed as of a specified date. A Type II examination goes further by also evaluating whether those controls operated effectively over a defined period.
Passu completed its Type I examination earlier in 2026. The Type II report extends that independent assessment across six months of control operation.
Security beyond the report
No audit can make a system risk-free. Passu’s SOC 2 Type II report provides independent evidence that the controls in scope were suitably designed and operated effectively during the review period.
Passu also supports SAML single sign-on, encrypts data at rest and in transit, offers private connectivity through AWS PrivateLink, and can be deployed in a private VPC. These measures support the security needs of institutional credit teams alongside each customer’s own vendor-risk and information-security review.
Supporting institutional diligence
Passu is an AI-native research platform for institutional corporate credit. It helps analysts work across SEC filings, earnings transcripts, corporate events, prior research, and portfolio context while keeping conclusions linked to their sources.
For security, procurement, and investment-technology teams evaluating Passu, the Type II report provides a structured basis for diligence on the controls surrounding the platform. It is evidence for a review, not a substitute for one.
Request the report
SOC 2 Type II reports contain detailed descriptions of systems, controls, testing procedures, and results, so they are restricted-use documents rather than public marketing materials. Current customers and qualified prospective customers can contact Passu to request access through the security-review process.
Security is ongoing work. Passu will continue maintaining and strengthening its controls as the platform and the needs of institutional credit teams evolve.
Schuyler leads product and engineering at Passu. He was previously head of engineering at AI real estate firm Zuma, backed by Andreesen Horowitz, and was a quantum computing scientist at Amazon and Rigetti Computing.
