Diligence answers live in the product, not only in a slide after the demo.

At a glance

Held to the bar financial advice data demands.

A short list for diligence. Deeper architecture and how to request the report are below.

Request SOC 2 report

Compliance program

How the program stays ready between exams

Practices that support SOC 2 Type II for a financial advice platform include ongoing monitoring, evidence you can hand over, and a clear path when a questionnaire arrives. The program is built so drift can be fixed before diligence asks, rather than only during annual audit season.

Security and compliance controls are watched on an ongoing cadence. Control evidence is collected and organized so customer diligence, security questionnaires, and auditor requests move without an ad-hoc screenshot hunt. Information security, access, and operational policies are maintained as living documents that map to SOC 2 control expectations and are reviewed as the product and infrastructure change. Employee and operator access gets periodic review so privileges stay aligned with role across client, reporting, and Mission Control surfaces. Critical vendors that touch infrastructure, observability, or customer data go through a vendor-risk process appropriate for a SOC 2 Type II program. Independent SOC 2 Type II examination covers operating effectiveness of controls over a period—the bar RIA and enterprise buyers expect for financial platforms.

Data protection

Encrypt, scope, and keep secrets out of code

Encryption and access patterns stay consistent in transit, at rest, and across service roles, so a diligence questionnaire does not get a different story in each environment.

Client and API traffic is designed to use TLS (TLS 1.2+) at the edge, and sensitive service-to-service paths stay inside the AWS network where practical. Core data stores and object storage are encrypted at rest; sensitive reporting tables use customer-managed KMS keys with key rotation enabled. Operational secrets are designed to live in AWS Secrets Manager, retrieved by scoped service roles, not hard-coded into application images. Infrastructure and application roles follow least-privilege IAM patterns so services receive only the permissions required for their job.

Infrastructure

AWS, designed as code

Athena’s production posture sits on Amazon Web Services with CloudFormation-managed infrastructure so network, identity, data, and AI controls can be reviewed and reproduced across stages.

Application workloads run in Amazon VPC with private subnets across availability zones, behind private load balancing rather than as publicly exposed task hosts. Public surfaces terminate TLS at the edge; AWS WAF managed rule sets help filter common web exploits before traffic reaches application layers. Environments are provisioned with AWS CloudFormation (infrastructure as code) so network, identity, data, and AI controls can be reviewed, versioned, and reproduced. API activity monitoring, service health alarms, and application observability—CloudTrail, CloudWatch, and Datadog—are part of the operating model so unusual changes and production issues can be investigated quickly.

Financial data operating model

Built for advice data, custody context, and firm operators

Household PII, account context, and AUM-related signals are treated as regulated-practice data, not generic SaaS telemetry. Design favors isolation, scoped access, and reconstructable activity so a reviewer can follow what a client saw and when. Advisor and operations surfaces use Cognito-backed identity with group and OAuth-scope packages so reporting, Mission Control, and tooling access can be granted by duty, not as a flat admin model. Mission Control and reporting paths are designed with domain and package isolation so operators see the book they are authorized for, and fail closed when tenancy cannot be resolved. Critical DynamoDB tables enable point-in-time recovery; object storage for user uploads uses server-side encryption and blocks public bucket access by default.