CustomGPT.ai is SOC 2 Type 2 compliant
CustomGPT.ai is a SOC 2 Type 2 compliant AI platform, so your security team can rely on an independent audit of how it controls, protects and keeps data available instead of a vendor's word.
SOC 2 compliance
What SOC 2 compliance means
SOC 2 is an independent audit of how a company controls access to data, keeps it available, and keeps it confidential. For customers, it means you can trust a vendor with your data instead of relying on their word alone. Read more about SOC 2 Type 2
See the full report and more detail in our Trust Center.
Your Data belongs to you
- Encrypted in transit and at rest
- Each agent is its own isolated workspace
- Not used to train any AI model, ours or anyone else’s
- You control deletion of your source files
Testimonials
Trusted by security leaders
“The achievement of SOC 2 Type 2 certification by CustomGPT.ai underscores their commitment to maintaining the highest standards of data security and operational excellence. This not only reinforces trust but also ensures compliance with industry best practices, making CustomGPT.ai a reliable and trusted supplier to esteemed organizations like ICTTF.”
Compliance
Related Compliance Resources
Questions about SOC 2 compliance
Is CustomGPT.ai SOC 2 compliant?
Yes. CustomGPT.ai holds a SOC 2 Type 2 report from INTERCERT CPA LLC, an independent CPA firm, covering security, availability and confidentiality from May 24, 2025 to May 23, 2026, with zero exceptions across all 165 controls tested. The report, issued July 27, 2026, is available on request; see the SOC 2 Type 2 certification page for the scope.
Who performed the audit?
INTERCERT CPA LLC, an independent CPA firm.
What’s the difference between SOC 2 Type 1 and Type 2?
Type 1 checks whether controls are designed correctly at a single point in time. Type 2 checks whether those controls actually worked over a longer period. Ours covers twelve months, which is what most security teams look for.
How do I get a copy of the report?
Request it through our Trust Center.
Does this mean my data isn’t used to train AI models?
That’s a separate commitment, and yes — your content isn’t used to train any model. SOC 2 is what gives you independent proof the controls behind that commitment were actually tested, not just promised.
Which parts of SOC 2 does this cover?
Security, Availability, and Confidentiality.
Is SOC 2 the same as GDPR?
No. SOC 2 covers security controls. GDPR covers how EU personal data is handled. We address both — see our GDPR page for that side.
Should I ask for more than just a SOC 2 report when evaluating an AI vendor?
Yes, SOC 2 covers security controls, not whether an AI’s answers are accurate. We handle that separately: every answer CustomGPT.ai gives includes a source citation you can check.
Do you train any AI model on my data — not just the main chat model?
No. That includes embeddings, spam filters, and any other model we run — none of them are trained on your data.
How is my data kept separate from other customers?
Each agent is its own isolated workspace, controlled by account and user-level access settings. Content in one agent isn’t visible to another, even within the same account.
What happens when I delete a file?
Deletion starts immediately when you request it.