SOC 2 announcement email template
Verge, an announcement email, finished in HTML.
An email telling customers where your SOC 2 audit stands, what the report covers and how to request it under NDA. Send it when a report is issued or an audit period starts, with the status rows edited to match.
Read the email as text
VERGE
TRUST UPDATE · OCTOBER 2026
Our SOC 2 Type 1 report is ready.
An independent auditor has examined how our security controls are designed. The Type 2 audit, which tests those controls in operation over six months, started on October 1.
Hi friend. Your security team may already have asked us for this. Below is where the audit stands, what the report covers, and how to get a copy.
Where the audit stands
SOC 2 Type 1 report
Our controls as designed on August 31, 2026
Ready
SOC 2 Type 2 audit period
October 1, 2026 to March 31, 2027
In progress
SOC 2 Type 2 report
Issued when the auditor finishes the fieldwork
May 2027
Type 1 and Type 2
A Type 1 report is an independent CPA firm's opinion on whether our controls were suitably designed on one date. A Type 2 report covers the same ground and adds whether those controls operated effectively across the whole audit period.
If your vendor review needs Type 2, the Type 1 report and this timeline are what we can give you today. Everyone who requests Type 1 gets Type 2 the week it is issued.
What the report covers
In scope
Security, availability and confidentiality, three of the five trust services categories
Not in scope
Processing integrity and privacy. If your review needs either, reply and we will tell you what we have
System
The sending API, the dashboard, and the infrastructure and people that run them
Auditor
An independent CPA firm, named in the report
Dates
Type 1 as of August 31, 2026. Type 2 from October 1, 2026 to March 31, 2027
How to get a copy
The report describes our systems in detail, so we share it under NDA. Request it on the trust page, accept the one-page NDA there, and the PDF arrives within one business day. If your company already has an NDA with Verge, say so in the form and we will use that one.
The same page has our security overview, the list of subprocessors and our answers to the common security questionnaires, with no NDA needed.
Questions about the report, or a questionnaire due this week? Reply to this email. It comes to me.
Ines Duarte
Head of security, Verge security@example.com
Verge · Sent to owners and admins on every Verge account You get security notices because you manage a Verge account. Unsubscribe · View in browser
