#SOC 2 Readiness Statement

STM-GL-012 v1.0.0, Last Modified On 31 July 2026, Tier: Public

Edsol Edtech Pvt. Ltd. has no SOC 2 report of any type. No examination has been commenced and no CPA firm has been engaged.

A note on vocabulary, because it is routinely got wrong. SOC 2 produces a report containing a practitioner's opinion. It does not produce a certificate, and no organisation is "SOC 2 certified". Pensieve Labs will not use that phrase and a hospital should treat any vendor that does as having not read its own report.

---

#Purpose

To state plainly whether Pensieve Labs intends to obtain a SOC 2 report, when, in what order relative to ISO/IEC 27001, and why that order was chosen.

---

#1. Current position

---

#2. Sequence, and why SOC 2 comes after ISO/IEC 27001

Pensieve Labs will obtain ISO/IEC 27001:2022 first and SOC 2 second. The reasoning is stated so that a reviewer can disagree with it on the record:

1. The markets Pensieve Labs sells into ask for ISO, not SOC. Indian hospital chains, Danish and Norwegian regional procurement, UAE group hospitals and Australian private groups all treat ISO/IEC 27001 as the reference credential. SOC 2 carries real weight with hospitals owned by or linked to a United States parent, and close to none with an owner-operated Indian hospital.
2. The ISMS is the cheaper foundation. An operating ISO 27001 management system removes the majority of SOC 2 readiness work. Doing it in the other order pays for the same evidence twice.
3. A SOC 2 report is issued by a CPA firm licensed in the United States and enrolled in the AICPA peer review programme. That is a structural constraint, not a preference: an Indian chartered accountancy firm cannot issue a SOC 2 report, although India-based teams may perform the work under a US-licensed firm's signature. Engaging that firm is a separate procurement with its own lead time.

The consequence for a hospital evaluating Pensieve Labs today: if a SOC 2 report is a hard requirement of your procurement, say so early. It is not on the near-term path, and Pensieve Labs would rather tell you that in week one than in week six.

---

#3. Scope decisions taken in advance

---

#4. Milestones

Milestone 7 is a scheduling discipline, not a formality. The observation window is the single longest element of the SOC 2 timeline and it is the only one that runs without effort. It starts the day the Type I is signed so that the clock runs while Pensieve Labs sells.

---

#5. SOC 1: deliberately not pursued

SOC 1 (SSAE 18 / ISAE 3402) is relevant where a vendor's platform forms part of a customer's financial reporting control environment. Pensieve includes revenue-cycle, billing and claims functions, which is exactly the class of system a listed company's external auditor scopes in, so the question is not absurd.

Position: not pursued today. Pensieve Labs's near-term customers are privately held hospitals whose statutory audit does not depend on the platform in that way. This will be revisited if Edsol Edtech Pvt. Ltd. wins a listed or publicly funded customer whose auditor requires it, and the decision will be recorded here rather than in a conversation.

---

#6. What Pensieve Labs will never buy, and why it belongs in this document

HITRUST: no tier, ever, unless a United States customer appears. HITRUST e1, i1 and r2 are artefacts of the United States health-plan and health-system market, driven by HIPAA business-associate and payer requirements. No Indian, Australian, Danish, Norwegian or Emirati hospital procurement process asks for it, and the mid-tier alone would cost more than Pensieve Labs's entire certification programme through the SOC 2 Type II while unlocking nothing.

It appears in this document because a roadmap that lists only what a company intends to buy is less informative than one that also states what it has decided not to. WPR-GL-005 Section 6.4 carries the full list.

---

#7. What a hospital should do with this in the meantime

1. If SOC 2 is a hard procurement requirement, tell Pensieve Labs in week one. It is not on the near-term path.
2. If it is a preference, read CHK-GL-029. The Trust Services Criteria mapping is published and testable against WPR-GL-001 today, which is more than most SOC 2 reports allow a buyer to do: a Type II report is NDA-gated and its control matrix is rarely read.
3. When the Type II arrives, ask for the SOC 3. It is publishable and needs no NDA. Pensieve Labs has already committed to buying it in the same engagement letter.

---

#8. How this statement is kept honest

Re-issued within 5 business days of any milestone completing, and re-dated with a stated reason if a target slips. Previous target dates remain visible in the change history below. Reviewed quarterly against STM-GL-011 and WPR-GL-005.

---

#9. Declaration

---

#10. Change history