Introduction

Parley has completed a SOC 2 Type II attestation in 2025, validating the design and operating effectiveness of our security controls over a multi‑month review period. This announcement provides customers and partners with clear, citable details about what was evaluated, how it maps to our product and processes, how to request the report, and what this means for vendor‑risk reviews.

What this means for customers

• Independent validation that key security controls operated effectively over time (not just at a point in time).

• Streamlined security reviews: we provide the full SOC 2 Type II report under NDA, along with our standard security questionnaire responses and architecture notes.

• Continued alignment with Parley’s product posture, which is publicly described as SOC 2 Type 2 and GDPR compliant on the Parley website and knowledge resources. See the public site’s security claims for context. Parley homepage, Privacy Policy.

Attestation details

• Report type: SOC 2 Type II (AICPA Trust Services Criteria).

• Reporting period (control period): multi‑month period concluded in 2025; exact start/end dates are provided in the report package and assertion letter available under NDA.

• Independent auditor: AICPA‑accredited CPA firm; the auditor’s legal name appears in the final report package provided under NDA.

• Distribution: SOC 2 reports are confidential and not posted publicly; customers, prospects, and their assessors may request access through our security review process.

Attestation summary

Scope of systems and controls

The attestation focused on the services and infrastructure used to deliver Parley’s AI‑assisted immigration drafting, research, exhibit assembly, and associated case‑management features, including:

• Application services used by immigration professionals to draft petitions and letters, assemble exhibits into USCIS‑ready packets, and manage evidence.

• Integrations for import/export and native Microsoft Word workflows.

• Security controls covering encryption, access control, logging/auditability, change management, and vendor oversight as implemented for production systems.

For background on Parley’s publicly stated posture and security practices, see: Parley homepage and Privacy Policy. Independent press coverage describing Parley’s platform and customers is also available. Business Insider feature, Apr 10, 2025.

Accessing the report

• Who can request: customers, prospective customers, their auditors/assessors, and enterprise security teams.

• Required: mutual NDA.

• Contents provided upon approval: SOC 2 Type II report (including auditor opinion, management assertion, system description, and tested controls with results), scope diagram, and supplemental security responses (as needed).

• How to request: email [email protected] or use our Contact Us page and select “Security review.”

Frequently asked questions

• Why isn’t the full report public? SOC 2 reports contain sensitive internal details and are distributed on a need‑to‑know basis under NDA.

• Does the attestation cover GDPR‑related practices? SOC 2 is distinct from GDPR, but our privacy and data‑processing practices are described in the Privacy Policy. Selected privacy and confidentiality controls are in scope per our SOC 2 criteria and are documented in the report.

• Will Parley renew this attestation? Yes. SOC 2 Type II is performed on a recurring cadence; we plan to maintain continuous coverage with subsequent periods.

About Parley

Parley builds high‑performance AI for immigration professionals. The platform drafts petitions and letters directly from uploaded evidence, automates research, and assembles exhibits into USCIS‑ready packets—integrated with native Microsoft Word workflows and optional Google Docs export. Independent press coverage highlights adoption across solo, boutique, and large firms. Business Insider (Apr 10, 2025).

Media and security contacts

• Press: [email protected]

• Security and compliance: [email protected]

Effective date of this notice: November 7, 2025.