SOC 2 Type II for a Legal E-Discovery Platform
An unqualified Type II report covering Security and Confidentiality, delivered before the Am Law 100 renewal cycle.
Client name withheld by agreement- Client
- Legal e-discovery software company
- Region
- Denver, Colorado
- Year
- 2025
- Duration
- 15 weeks
- Scope
- 96 controls · Azure, Okta and GitHub
- Practice
- AI, Cloud & Digital Trust
The challenge
What was at stake.
A legal e-discovery platform hosts privileged documents for large law firms and corporate legal departments. Its biggest customers had written SOC 2 Type II into their renewal terms, and the company had a Type I report that was already eighteen months old.
Confidentiality is the whole product. The controls had to prove that one matter’s documents could never surface in another, and that deleted data was actually gone.
What we did
The approach, step by step.
- 01
Criteria picked for the buyer
We scoped Security and Confidentiality around the review platform and processing pipeline, the two things law firm security teams ask about first.
- 02
Matter isolation proven
Tenant and matter separation in Azure was tested, logged and documented, and defensible deletion was built into the case-closure workflow.
- 03
Access governed in Okta
Joiner, mover and leaver steps, quarterly access reviews and privileged access to production were automated and ticketed.
- 04
Mock fieldwork
A full mock audit sampled every control. Seven gaps surfaced and were fixed before the observation period began.
- 05
Fieldwork with the CPA firm
We organized evidence by criterion and prepared control owners, so the independent auditor finished testing two weeks ahead of plan.
Outcomes
What changed, in numbers.
- 96
- controls operating through the observation period
- 0
- exceptions noted in the Type II report
- 7
- gaps closed before the window opened
- 100%
- of renewals requiring the report retained
Our customers protect privilege for a living. Now we hand them a report that shows we do too.
Services delivered
Related engagements
More work in AI, Cloud & Digital Trust.
-
Seattle, Washington · 22 weeks
AI, Cloud & Digital Trust · 2026 · OngoingISO/IEC 42001 and Adversarial Testing for a Contact-Center AI ProviderVoice agents that can no longer be talked into reading back card numbers, and an AI management system heading for certification.
-
Houston, Texas · 24 weeks
AI, Cloud & Digital Trust · 2024Cloud Security Platform for a Genomics LaboratoryPetabytes of patient genomes locked behind one set of guardrails, with no slowdown in sequencing turnaround.
-
Huntsville, Alabama · 18 weeks
AI, Cloud & Digital Trust · 2025CMMC Level 2 for a Satellite Communications IntegratorEvery practice met at the C3PAO assessment, with no POA&M items carried forward.
Let’s talk about your version of this.
Share what you are up against. A senior practitioner who has delivered this kind of work will reply within one business day.