TruYields Completes SOC 2 Type 2 Examination
TruYields has received its SOC 2 Type 2 attestation report. The examination was carried out by independent audit firm Sensiba and covers the Security, Availability and Confidentiality Trust Services Criteria over an observation period from 1 June to 31 August 2026. Sensiba’s signed opinion is dated 16 September 2026.
For institutions evaluating onchain yield infrastructure, a SOC 2 Type 2 report is a familiar part of vendor and third-party risk diligence. It gives them independent evidence of how we operate, tested over time by an auditor working to AICPA attestation standards.
What a SOC 2 Type 2 Report Tests
SOC 2 is a framework developed by the American Institute of Certified Public Accountants (AICPA) for examining a service organisation’s controls against its Trust Services Criteria. A Type 1 report assesses whether those controls are suitably designed at a single point in time. A Type 2 report goes further: the auditor tests whether the controls operated effectively across a defined observation period, using evidence drawn from that period.
Our examination covered three criteria:
Security covers the protection of systems and information against unauthorised access, disclosure and damage. It is included in every SOC 2 examination and spans areas such as logical access, change management, system monitoring and risk assessment.
Availability covers whether systems are available for operation and use as committed.
Confidentiality covers whether information designated as confidential is protected as committed.
Why Institutional Diligence Teams Ask for It
Institutions that allocate through a third party run that provider through their own vendor and third-party risk processes. The questions come from risk, compliance and information security teams, and they are consistent: who can access production systems, how changes are reviewed and deployed, how incidents are detected and handled, how systems stay available and how confidential client information is protected.
A Type 2 report lets those teams work from an independent auditor’s testing across the observation period, alongside their own questionnaires. For a provider operating onchain, that evidence helps diligence teams assess the operational environment behind the product, not only its technical architecture.
Where It Sits Alongside Our Smart Contract Audits
Our smart contracts go through independent third-party security audits, and every audit report is published in full on our Trust Centre. Those audits examine the code. The SOC 2 examination addresses the organisation and the operational controls around it. For institutional diligence, the two answer different questions, and both are now independently assessed.
“Institutions assess us the way they assess any service provider that sits inside their operations,” said Matt Molloy, CEO & Co-Founder. “This report gives their diligence teams independent assurance over our operational controls, tested by an auditor rather than taken on our word. That is part of what makes onchain yield usable inside an institution.”
Requesting the Report
SOC 2 reports are shared with clients and prospective clients as part of diligence, and access can be requested through our compliance portal. The portal, our smart contract audit reports and our security partners are all on the Trust Centre at truyields.com/trust-centre.
