Agentic AI revenue platformHow Arali AI earned its first SOC 2 Type II report in four months.
Arali needed its first SOC 2 Type II report, and a penetration test of its platform to go with it. We ran the two as one engagement, and the auditor issued Arali’s report four months after the audit period began.
- SOC 2 Type II
- Processing integrity
- Penetration test
- Evidence
- Audit support
An agentic AI platform for revenue teams.
Arali makes an agentic AI revenue platform for sales and customer success teams. It builds customer context, reads the signals and surfaces the next best action, and its AI agents carry that action out across the revenue lifecycle.
What Arali needed.
This was Arali’s first SOC 2 Type II examination, with its platform tested alongside it.
- 1
A SOC 2 Type II report, examined and issued by a US-licensed CPA firm.
- 2
Four Trust Services categories. The plan was Security, Availability and Confidentiality, then Processing Integrity joined the scope and took the report to 43 criteria.
- 3
A grey-box penetration test of the production platform, its web application and its MCP endpoint, with the CRM inside the scope.
- 4
A retest of the fixes once the first round of testing was done.
What we did.
We ran the audit work and the penetration test side by side, from the first scoping call to the signed report.
- Trust Services categories
- Security, Availability, Confidentiality and Processing Integrity
- Tested
- The production web application and the MCP endpoint
- Roles tested
- Member, admin and owner
- Testing standards
- OWASP Testing Guide v4 and OWASP ASVS Level 2
The register
- Roadmap
We began with Arali’s compliance roadmap and shaped one engagement around it: the SOC 2 Type II audit, a penetration test of the platform and a retest of the fixes.
- Scoping
A scoping questionnaire at onboarding, then a kickoff call with Arali’s team. We confirmed the whole web application was in scope for testing, the CRM included.
- Controls
We mapped Arali’s controls to the 43 criteria across Security, Availability, Confidentiality and Processing Integrity.
- Evidence
We built the evidence with Arali’s engineers, and held a working session with the team in August to work through their questions.
- Walkthrough
Arali’s team walked us through the platform before testing began.
- Testing
Grey-box testing of the production web application and the MCP endpoint in late July and early August, signed in as a member, an admin and an owner, against the OWASP Testing Guide v4 and OWASP ASVS Level 2.
- Retest
We re-tested the fixes in September, 30 days after testing ended.
- Audit
We supported Arali through the examination until the auditor issued the signed report in October.
What Arali has now.
Delivered
- Arali’s first SOC 2 Type II report, issued by the auditor in October 2026 and covering June to August 2026.
- A penetration test report on the production web application and the MCP endpoint.
- A retest report on the fixes, from September 2026.
- The penetration test also served as evidence for the SOC 2 examination.
- Arali now shows its SOC 2 Type II on its own trust portal, across all four categories.
From June to October.
- June 2026
Arali’s audit period opened on 1 June. It ran to 31 August.
- July 2026
A walkthrough of the platform with Arali’s team, then grey-box testing from late in the month.
- August 2026
Testing finished early in the month. We held a working session with Arali’s team on their evidence questions, and the audit period closed on 31 August.
- September 2026
We re-tested the fixes, 30 days after testing ended.
- October 2026
The auditor issued Arali’s first SOC 2 Type II report, four months after the audit period began.
Start your first SOC 2 Type II with us.
Behind this story are 300+ SOC 2 engagements across India, the US, the UK, Australia and the UAE. Tell us where your controls stand today and we will map the way to your report.
Related Reading
SOC 2 for AI Companies
Enterprise AI procurement, model/data security, and ISO 42001 pairing.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreVAPT / Penetration Testing
Manual-first web, API, network and mobile testing with retest included.
Read moreSOC 2 and Penetration Testing
No criterion mandates a pen test — your own control description does. Timing, scope and what gets rejected.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more