SOC 2 Type II — unqualified opinion
Innorve Inc. completed a SOC 2 Type II examination. The report was issued May 18, 2026 by ConstellationGRC CPA P.C. with an unqualified opinion, covering January 25–April 25, 2026.
Type II means the auditor tested that our controls operated effectively across the whole examination window — not a single point in time. The full report, including the auditor’s description of tests and results, is available under NDA in the Diligence Pack below.
We ship answers, not your data.
Your data stays yours. Engagements run against your institution’s own data inside your environment, and what leaves is a governed answer or artifact — not a copy of your records. Our cited Knowledge Fiber is the reference we bring; your operational data is never absorbed into it.
Hash-chained, tamper-evident records
Outcome records and decision packages are hash-chained: each entry carries a cryptographic hash of the one before it, so any later edit to an earlier record breaks the chain and is detectable on review.
We say tamper-evident, not tamper-proof. Hash-chaining makes changes detectable — it does not make records physically unchangeable, and we don’t use blockchain or call anything “immutable.” The point is an auditor can verify a record hasn’t been altered since it was written.
HIPAA-aligned approach
Where an engagement touches health-related information — for example, certain hardship, disability, or benefits workflows — we work to a HIPAA-aligned approach: minimum-necessary handling, access controls, and a Business Associate Agreement where one is warranted.
“Aligned” is deliberate wording: it describes how we design and operate, scoped to the specific engagement, rather than a blanket certification claim.
How we use AI, and who we rely on.
We disclose our material subprocessors and where AI sits in the work. AI accelerates analysis and drafting; a qualified human reviews and is accountable for every output that reaches a client. AI does not make final compliance determinations.
Large-language-model inference for analysis and drafting, under enterprise terms.
Governed data and processing platform for engagement workloads.
Automation runtime for governed production workflows.
Cloud infrastructure and hosting for engagement environments.
The authoritative, engagement-specific subprocessor list and data-flow diagrams ship in the Diligence Pack and in your engagement’s data-processing addendum.
What you can confirm without emailing us
One request. Everything your review needs.
Tell us where to send it and we’ll grant access to the full pack for your review team. Sensitive documents (the SOC 2 report itself, the DPA, and the authoritative subprocessor list) are shared under NDA.
- SOC 2 Type II report (under NDA)
- Data-processing addendum & data-flow diagram
- Subprocessor list & AI-use statement
- Security overview & standard questionnaire responses
Access is granted by a person, not automatically. Expect a reply within one business day.
Diligence cleared? Bring us the workflow.
The trust ladder ends where the work begins. When your review is done, the fastest next step is one stuck workflow.
