Announcing Cyrus’s SOC 2 Type II compliance

Cyrus has completed its SOC 2 Type II audit. Teams evaluating Cyrus now have an independent assessment of how our controls operated over the audit period to support their security review.

Prescient Security conducted the independent SOC 2 Type II audit.

In January, we announced SOC 2 Type I compliance and our plan to work toward Type II. This completes that next step.

SOC 2 is an attestation framework developed by the American Institute of Certified Public Accountants (AICPA). An independent auditor examines a service organization's controls against the applicable Trust Services Criteria.

The distinction between the two report types is time and evidence:

• Type I evaluates the design of controls at a specific point in time.
• Type II also evaluates how effectively those controls operated over a defined period, with tests and results documented in the report.

For a team reviewing Cyrus, Type II provides evidence about the operation of the controls covered by the audit. The report sets out the systems, criteria, and period examined so reviewers can assess its relevance to their own requirements.

Connecting an AI development agent to your workflow raises practical security questions: what can it access, where does it run, and how is that access managed? Those questions matter when the workflow includes private repositories, issue discussions, and development credentials.

The Type II report gives your security and procurement teams an independent assessment to use alongside their review of your Cyrus configuration.

Your deployment, integrations, and model provider choices still matter. Our documentation explains how Cyrus fits into your development workflow, and our Trust Center provides security information for your review.