Solarpro Security & Compliance
We're building toward SOC 2 Type 2, ISO 27001, ISO 27701, and ISO 27017. This page is the on-the-record summary of where we are today, what we already have in place, and what's next.
Last updated July 30, 2026
Certifications in progress
We publish the framework, current status, target window, and the evidence we have today. Updates land here as we ship, not on a marketing site six months later.
| Framework | Status | Target | Current evidence |
|---|---|---|---|
| SOC 2 Type 1 | In Progress | Q4 2026 | Audit scheduled for October 2026; all P0 controls operating; 10 policies approved; 84 controls documented in self-built matrix |
| SOC 2 Type 2 | Planned | Q2-Q3 2027 | Observation period begins immediately after Type 1 report issuance; will run for the standard 6-month window. |
| ISO 27001:2022 | In Progress | Q3-Q4 2027 | ISMS framework established; risk register and asset inventory complete; 80% control overlap with SOC 2. |
| ISO 27701:2019 (Privacy) | In Progress | Q3-Q4 2027 | PII mapping in flight; data subject rights workflows designed; privacy impact assessment template approved. |
| ISO 27017:2015 (Cloud) | In Progress | Q3-Q4 2027 | Shared-responsibility matrix drafted for Vercel/Neon/Render/Cloudflare; cloud-specific controls documented. |
Security practices
The controls already operating in production. None of these are aspirational.
Encryption at rest and in transit
AES-256 at rest; TLS 1.2+ in transit.
MFA on all admin access
TOTP enforced for every admin account.
Quarterly access reviews
Reviewed every 90 days; stale grants revoked.
Daily encrypted backups
Point-in-time recovery; backups stored separately.
Continuous vulnerability scanning
Dependabot on every dependency; secret scanning on every commit.
Documented incident response plan
Severity-graded playbooks; quarterly tabletop exercises.
24-hour breach notification
Confirmed incidents reported to customers within 24 hours.
Subprocessors
Third parties that process customer data on our behalf. We notify customers of material changes at least 30 days in advance.
| Subprocessor | Purpose | Data accessed |
|---|---|---|
| Vercel | Hosting | Application data, logs |
| Neon | Database | Customer data |
| Render | ML inference | Image bytes (transient) |
| OpenAI | Vision classification | Image bytes (transient, no retention per API terms) |
| Anthropic | Vision analysis | Image bytes (transient, no retention per API terms) |
| Google Maps / Solar API | Geocoding + roof data | Address, lat/lng |
| Stripe | Payments | Card tokens (not raw cards) |
| Resend | Transactional email | Email addresses |
Full subprocessor register (DPA status, cert dates, last reviewed) at compliance/vendors.csv.
Policies
Our full policy library covers SOC 2, ISO 27001, 27701, and 27017. Customer copies are available on request.
- Information Security
- Acceptable Use
- Access Control
- Data Classification & Handling
- Incident Response
- Change Management
- Vulnerability Management
- Logging & Monitoring
- Backup & Recovery
- Vendor Risk Management
Contact
For security questions, vulnerability reports, or to coordinate a vendor review, reach the security team directly.
- ray@underthesun.solutions
- Report a vulnerability
- Acknowledgement within 24 hours, triage within 72 hours
Request our SOC 2 report
We share our latest SOC 2 report under NDA with current and prospective customers. Email us with your procurement contact and we'll send it the same business day.
Request our SOC 2 report