SOC 2, not engaged, not started, and not the thing most buyers think it is

No SOC 2 audit has been engaged. No auditor has been selected. No report exists, Type I or Type II.

Independent certification sits on a 2027 horizon. Nothing here is closer to done than that.

What SOC 2 actually is

It is not a certificate, and the difference matters more than the acronym.

SOC 2 is an attestation report, written by an independent licensed CPA firm, on whether a set of controls, the ones the company itself defined, were designed appropriately and, in a Type II, operated effectively over a stated period. It is built on the AICPA's Trust Services Criteria: security, availability, processing integrity, confidentiality, privacy.

Three consequences buyers routinely miss:

• The company chooses the controls and the scope. Two companies can both hold a SOC 2 while making very different commitments. The scope section is where the meaning lives, and it is the section nobody reads.
• Type I is a point in time; Type II is a period. A Type I says the controls were designed sensibly on one date. Only a Type II says they actually ran.
• It is an opinion on process, not a test of your cryptography. A SOC 2 would say nothing about whether our BBS+ implementation is sound. That takes a cryptographic review, which is a different engagement, and we have not had one of those either.

Where we actually are

Nothing has started. Not an auditor shortlist, not a readiness assessment, not a control inventory, not a Type I. The honest answer to "are you SOC 2?" is no, without qualification, and we would rather give that answer than the one that sounds like momentum.

Why not yet: a Type II attests to controls operating over a period, for a company with production operations and customers. That is a real reason, not an excuse, and it stops being one the moment a customer arrives.

A contradiction on our own site

Our live security page currently states "SOC 2 Type II, Audit in progress." Our internal compliance record (the single source every surface is supposed to render from) says the audit has not been performed and no engagement exists.

Those cannot both be true. This page states the second, because it is what our own systems say and because "in progress" is precisely the kind of claim a due-diligence process will ask for evidence of. If an engagement has in fact begun, the record needs updating and this page with it. Until then, treat "in progress" as unsupported.

What a buyer should do instead

Ask for the thing you actually need, which is usually not the acronym:

• Ask what we do not hold: the list is on this site and it is long.
• Ask what is checkable today. did:solidus is registered in the W3C DID Method Registry, which is a registry listing, not a standard or an endorsement. Our DIF membership is a membership, not a certification. Both are verifiable in a minute; neither is a security assurance.
• Ask for the gap list rather than the certificate. A vendor with no certifications and an accurate gap list is a more predictable counterparty than one with a certificate whose scope excludes the thing you care about.

If your procurement process requires a SOC 2 report, we fail that requirement today. That is the correct outcome, and saying so early is cheaper for both of us than saying it in week six.