When a lender sends borrower files to a new vendor, those files carry bank statements, payslips, tax returns and identity documents. Before any of that leaves the building, the lender’s security team wants proof, from someone other than the vendor, that the vendor’s controls work. In lending, that proof is usually a SOC 2 Type II report.
Kita now has one. Advantage Partners, an independent audit firm, issued our SOC 2 Type II report on 12 October 2026, with an unqualified opinion.
- Report
- SOC 2 Type II
- Auditor
- Advantage Partners
- Period examined
- 18 May to 18 August 2026
- Report issued
- 12 October 2026
- Opinion
- Unqualified
What a SOC 2 Type II report is
SOC 2 is a reporting framework set by the AICPA. An independent CPA firm examines a company’s controls and writes a report on what it found. It is an attestation, not a certificate: there is no SOC 2 certificate to hang on a wall, and any vendor calling itself “SOC 2 certified” is using the wrong word.
There are two types. A Type I report checks whether controls are designed properly on a single day. A Type II report goes further and tests whether those controls actually operated, day after day, over a period of months. Design is a promise; operation is the evidence. That is why most procurement teams ask for Type II.
What our audit covered
Advantage Partners examined how our controls operated from 18 May to 18 August 2026. Over that window, the auditors sampled evidence and tested whether the controls did what we said they do.
The report carries an unqualified opinion. That is the best outcome a SOC 2 audit can have: the auditor concluded that our description of our system is fair and that the controls were suitably designed and operated effectively over the period.
A SOC 2 report is not a judgment on the quality of a credit assessment or the accuracy of an individual extraction. Your team should still test Kita on its own files, and your underwriter still makes every lending decision. What the report tells you is that the controls protecting your borrowers’ data were independently tested and held up.
How it fits with ISO 27001
In September we became ISO 27001 certified. The two answer different questions. ISO 27001 certifies that we run a management system for information security: we identify risks, choose controls and keep improving them. SOC 2 Type II reports on whether specific controls worked over a defined period.
Security questionnaires ask for one, the other, or both, depending on the lender and the market. Kita now has both, from the same independent firm, Advantage Partners.
What it means for your vendor review
A current SOC 2 Type II report answers a large share of a typical security questionnaire. Your team can map our tested controls to your own requirements rather than starting from a blank spreadsheet, which usually means fewer rounds of follow-up questions and a faster path to a pilot.
SOC 2 reports are shared under NDA, because they describe a company’s controls in detail. We plan to renew ours every year, so the period it covers stays recent.
Request the report
Email support@kita.ai to request our SOC 2 Type II report or ISO 27001 certificate. Our Trust Center and security page cover the rest of our security documentation.
If you are evaluating Kita, we can help your security team find what it needs to finish its review.
Frequently asked questions
Is Kita SOC 2 Type II compliant?
Yes. Advantage Partners, an independent audit firm, issued Kita’s SOC 2 Type II report on 12 October 2026 after examining how our controls operated from 18 May to 18 August 2026. The report carries an unqualified opinion.
Is SOC 2 a certification?
No. SOC 2 is an attestation report issued by an independent CPA firm under AICPA standards. There is no SOC 2 certificate. ISO 27001, which Kita also holds, is a certification.
What is the difference between SOC 2 Type I and Type II?
A Type I report looks at whether controls are designed properly at a single point in time. A Type II report tests whether those controls actually operated over a period of months. Type II is the one most security and procurement teams ask for.
How do I get a copy of Kita’s SOC 2 report?
Email support@kita.ai. The report is shared under NDA, which is standard practice for SOC 2 reports.
How often is the SOC 2 report renewed?
Kita plans to renew its SOC 2 Type II report annually, so the period it covers stays recent.