Does Profound or Peec AI meet SOC 2 requirements for our data: A Practical Decision Framework

What can you conclude from the public evidence?

This is a dated public-status comparison. We have not read either vendor's restricted audit report and cannot give either platform security approval for your deployment.

Profound: a report is listed, but its contents still matter

Profound's June 10, 2025 announcement states that it achieved SOC 2 Type 2. Its current Trust Center lists a “SOC 2 Type 2 & HIPAA Report” with a lock. The native view below shows that access boundary and a sample of its listed subprocessors.

Open this image at full size

Native Profound Trust Center, captured September 28, 2026. The listing establishes that a report can be requested; it does not reveal its period, opinion or exceptions. A subprocessor listing is also not evidence that every dependency falls within the audit.

Peec AI: request a current status update

Peec's official AI Instructions page, dated July 2026 and checked September 28, still describes SOC 2 as being pursued. That does not prove its status has remained unchanged since July. Ask whether a report is now available, and obtain it through the vendor's authorized process if so.

Open this image at full size

Native excerpt of Peec's own status in its public comparison. The crop retains the security label and Peec's statement, excluding the other vendors' cells. The page's separate product comparisons are not a security assessment.

Does the evidence cover your actual workflow?

Start with the data your workflow actually needs, then ask whether the vendor's evidence covers that exact boundary. Xtrusio's question-level record, shown later, provides a concrete example of what to inventory: public buyer questions and separate engine records. The same security requirements apply to Xtrusio; a useful monitoring screen is not an audit report.

What does a Type II report establish?

SOC 2 concerns controls within a described service system. Type II addresses how those controls operated over a stated period, rather than only their design at a point in time. It is not a permanent certificate covering everything a company sells.

The AICPA's SOC resources distinguish security, availability, processing integrity, confidentiality and privacy. Check which categories your report actually covers. Encryption claims or a cloud provider's own assurance do not replace the vendor's report for the service you will use.

How should you classify the proposed data flow?

Ask “Can we justify this particular workflow under our policy?” A small public-question evaluation, a workspace containing staff identities and an integration ingesting private logs have different data boundaries.

These are planning categories, not claims that every vendor collects every listed field. Get the actual data inventory for your purchased modules and integrations.

Which report checks determine whether procurement can proceed?

Ask for the current report through the vendor's normal controlled-access process. Keep restricted assurance documents within your approved review environment. A sales summary helps you find the report; it cannot replace reviewing it.

The AICPA's report walkthrough identifies opinion types, customer controls, exceptions, subservice treatment and bridge letters as review topics. Its SOC 2 reporting guide explains the role of system-control design, operation and effectiveness. Apply those concepts to the service you are buying.

“Carve-out” means a dependency's controls are excluded from the report's examination; it does not automatically mean that dependency is unacceptable. “Customer controls” are tasks your team must perform. A bridge letter addresses developments after the report period, but does not itself extend the independent auditor's testing into a new period.

Which data-term questions need clarification?

Profound's published DPA specifies notice without undue delay and within 72 hours after awareness of a defined incident involving customer personal data. Match that definition and timing against the agreement you will sign. The Trust Center's provider list also gives your reviewer a starting point for checking recipients and roles.

Peec's privacy policy needs a precise region question. Section 1 describes its PostHog instance as being in the USA; section 3 describes PostHog EU Cloud for product analytics. These may refer to different processing contexts, but the page alone does not resolve the distinction. Ask which instance receives your users' data, which fields it receives and which contractual terms apply.

The policy describes core data on Google Cloud and says deleted content may briefly remain in backups. Ask for the applicable deletion schedule and recipients. We found no model-training assurance in the reviewed privacy text, so obtain an explicit answer instead of assuming one from the SOC 2 status.

What would a narrowly scoped evaluation record look like?

Open this image at full size

Historical August Xtrusio question-level view. It shows two public questions and separate engine controls. It illustrates the content to inventory; it does not prove completed responses, access controls, storage location or SOC 2 status.

For an initial evaluation, agree on a list of public buyer questions that contains no customer names, private contracts, credentials or unreleased product information. Separately record the account information and service providers involved. Add restrictions stating what cannot be uploaded or connected.

If you later want private integrations, return to the security gate for that expanded scope. Starting with public questions reduces what you need to send; it does not waive a mandatory audit requirement or make a vendor automatically safe.

When should you approve, make an exception or stop?

Approve only the scope your authorized security owner has accepted. If a current Type II report is mandatory, an unavailable report cannot be offset by strong product features or by completing the other checklist items.

For example, resolving seven of eight required items is 87.5% checklist completion. If the missing item is mandatory, that percentage does not authorize procurement. This is an illustrative decision rule, not a vendor score or a probability that your data is safe.

An exception is a separate, documented policy decision with an accountable approver, permitted data, compensating controls and a review date. If your policy permits no exception, stop. For Profound, the next step is current-report review. For Peec, first establish whether newer assurance exists, then apply the same review if it does.

At renewal, use the AI visibility renewal scorecard to compare delivered work, retained evidence and the next term’s cost alongside the security decision.

To assess a concrete monitoring scope, request Xtrusio's scoped free evaluation using buyer questions your team has approved for sharing. Agree on the data boundary before sending private material, and apply your security policy to Xtrusio as you would to any provider. Xtrusio has a free self-serve plan, and a managed service with a free trial, then tiered plans (details on request).