SOC 2 in progress. HIPAA BAA available. ISO 27001 controls mapped. All data encrypted at rest and in transit.