How Personaify reached SOC 2 Type 1.
Personaify builds AI that reviews design drawings and audits leases for commercial real estate. It wanted a SOC 2 Type 1 report across all five Trust Services Criteria by mid-August. We ran the gap assessment, built the control matrix with its team and reviewed the evidence control by control. The auditor issued Personaify’s report in August 2026.
AI that reads the drawings and the leases.
Personaify is a US company that builds AI for commercial real estate. Its platform automates design reviews and document audits, so landlords and tenants can open new spaces faster.
ADR Pro automates design review and tenant approvals for landlord and tenant drawings. Document Audit checks leases, work letters, MEP documents and design guidelines.
Customers upload their own drawings, leases and related documents for the AI to review, and that content can include personal information. So they want to see how it is protected before they sign.
What Personaify needed.
Customers wanted to see how their documents are protected, and Personaify wanted to show them soon.
- 1
A SOC 2 Type 1 report, the auditor’s point-in-time report on how its controls are designed.
- 2
All five Trust Services Criteria in scope: Security, Availability, Processing Integrity, Confidentiality and Privacy.
- 3
The report by mid-August.
What we did, step by step.
We mapped the controls to the criteria, drafted the paperwork and reviewed the evidence. Personaify’s team filed its evidence and signed where only the client can sign.
- 01Discovery
A discovery call in mid-July, then our SOC 2 Type 1 proposal, sent with a sample redacted report so Personaify could see what it would receive.
- 02Questions
Personaify’s CEO sent written questions on the proposal, and we answered them point by point. Personaify signed the proposal, then the engagement letter, and opened a shared Microsoft Teams workspace for the engagement.
- 03Scoping
A scoping questionnaire across nine areas of the business: business context, people and organisation, infrastructure and technology, software and applications, data management, security operations, third-party services, policies and procedures, and data retention. Personaify’s team had it complete by early August.
- 04Gap assessment
We reviewed the control plan Personaify’s team had started against what a Type 1 report needs, mapped each control to the criteria it supports and mapped coverage across all five categories. Where a category called for more, we proposed new controls.
- 05Control matrix
A control design matrix with a coverage check against every criterion in scope. We built it and worked through it with Personaify’s Security Lead.
- 06Evidence framework
One evidence folder for every control, each with a checklist naming exactly which artefact to file.
- 07Evidence review
Personaify filed its evidence in daily drops, and we reviewed it control by control as it arrived. The areas covered governance, risk assessment, vendors, access, devices, credentials, data classification, monitoring, incident response, change control, backup and recovery, and privacy.
- 08System description
We drafted the system description with Personaify’s team, along with the controls its customers are expected to have in place and the carve-out of its service providers.
- 09Internal review
Before the auditor’s examination, we reviewed every control and its evidence.
- 10Representation letter
We prepared the management representation letter, which Personaify’s management signed.
- 11Audit
We coordinated with the auditor through to issuance. The auditor examined the controls and issued Personaify’s SOC 2 Type 1 report.
What Personaify has now.
- Personaify’s SOC 2 Type 1 report, as of 15 August 2026, covering Security, Availability, Processing Integrity, Confidentiality and Privacy, issued by the auditor in August 2026.
- A gap assessment of Personaify’s control plan, with each control mapped to its criteria and a coverage map across all five categories.
- A control design matrix with a coverage check against every criterion in scope.
- An evidence framework of one folder per control, each with its own checklist.
- The system description, drafted with Personaify’s team, with the complementary user entity controls and the carve-out of service providers.
- The management representation letter, signed by Personaify’s management.
- Our review of every control and its evidence before the auditor’s examination, and coordination with the auditor through to issuance.
From July to August.
- Mid-July 2026
Personaify got in touch. A discovery call followed, then our SOC 2 Type 1 proposal.
- Late July 2026
We answered the CEO’s written questions point by point. Personaify signed the proposal and the engagement letter, and opened a shared Microsoft Teams workspace for the engagement.
- Early August 2026
The scoping questionnaire came back complete across nine areas. We ran the gap assessment, began the control design matrix and set up the evidence framework.
- Mid-August 2026
We reviewed Personaify’s evidence as it arrived, finalised the control matrix and reviewed every control and its evidence before the auditor’s examination.
- August 2026
The auditor issued Personaify’s SOC 2 Type 1 report, as of 15 August.
Let’s plan your SOC 2 report.
Tell us what you are building and when your customers need to see a report. We will scope it with you, drawing on 1,000+ audits and 300+ SOC 2 engagements.
Related Reading
SOC 2 for AI Companies
Enterprise AI procurement, model/data security, and ISO 42001 pairing.
Read moreType 1 vs Type 2
Which report to get first, and when to go straight to Type 2.
Read moreTrust Services Criteria
Security, Availability, Confidentiality, Processing Integrity, Privacy.
Read moreSOC 2 Overview
The AICPA attestation US and global enterprise buyers ask for.
Read moreCase Studies
Client stories from AI, healthtech and air cargo teams, and representative engagements by sector.
Read moreProof & Track Record
Every number we publish — explained, sourced and verifiable.
Read more