Safety & Compliance

DEOS SOC 2 Type 1 Readiness

Control Readiness And Independent Examination Preparation

I REVLAB, INC. | DEOS
Prepared by: DEOS Engineering, Management, and Legal Departments
Document: Management Readiness Statement Last Updated: November 4, 2026

DEOS is SOC 2 Type 1 compliant-ready and is presently undergoing preparatory work for an independent examination by a licensed third-party CPA firm and issuance of a SOC 2 Type 1 report. The readiness designation reflects management's stated control-readiness position for the components described below. Preparation encompasses the system description, control documentation, responsibility assignments, and supporting examination evidence.

What SOC 2 Type 1 Means

SOC 2 is an independent assurance examination conducted under AICPA standards. A Type 1 examination addresses management's description of the system and the suitability of the design of its controls as of a specified date. The examination's scope is established through the defined system boundary, service commitments, system requirements, and selected Trust Services Criteria.

The DEOS readiness framework addresses the Security Common Criteria and related Availability, Processing Integrity, Confidentiality, and Privacy control areas. It encompasses dealership data access, connected systems, cloud processing, AI agents, communications, supporting personnel, and contracted infrastructure within the defined service boundary. The components below organize that readiness for dealership and technical review.

Control Readiness Summary

The references organize the DEOS control components against relevant criteria. AI and tenant-specific controls apply those criteria to the DEOS architecture. The independent examination follows its agreed scope and system description.

Control Components

01. Governance And Accountability

Compliant-ready. The governance framework assigns management oversight and named responsibility for engineering, security, privacy, operations, and risk decisions. Personnel responsibilities, confidentiality obligations, appropriate conduct, and escalation routes support consistent protection of dealership information. Management directs control ownership and the treatment of material risks.

02. Policies And Security Communication

Compliant-ready. Documented policies communicate security requirements, permitted data uses, access responsibilities, incident reporting, and customer obligations. The policy framework connects the Subscription Terms, Privacy Policy, AI Governance Policy, TCPA Policy, and Dealership Data Safeguards. Material changes and relevant operating instructions follow controlled communication procedures.

03. Risk Assessment And Treatment

Compliant-ready. Risk assessment addresses dealership information, connected systems, personnel access, cloud dependencies, cyber threats, and AI-enabled actions. Risks have identified owners, treatment decisions, and escalation paths. New providers, integrations, processing purposes, and material system changes enter the risk-review process before their approved use.

04. Control Monitoring And Corrective Action

Compliant-ready. The control framework provides for monitoring, access reviews, evaluation of exceptions, and management review of significant findings. Corrective actions carry assigned ownership and follow-through. Control evidence and issue records support review of whether the implemented design continues to match service requirements and the defined system boundary.

05. Control Activities And Responsibility Separation

Compliant-ready. Defined approvals and restricted administrative permissions govern sensitive activities. Production changes, access grants, material configuration decisions, and risk exceptions follow authorized procedures. Review responsibilities and separation of duties, or documented compensating review where appropriate, reduce the risk of unauthorized or unchecked activity.

06. Identity, Authentication, And Access Management

Compliant-ready. Access design uses authenticated identities, role-based permissions, least privilege, and multifactor authentication for privileged and other applicable access. Account provisioning, role changes, support access, and removal of obsolete access follow defined procedures. Authorization is enforced at relevant backend boundaries, including API and agent operations.

07. Dealership Data And Tenant Separation

Compliant-ready. Each dealership has an identified, access-controlled tenant environment. Separation extends to records, retrieval context, conversations, generated assets, caches, queues, exports, and support access. Group, agency, and OEM permissions remain limited to expressly authorized environments. Shared infrastructure does not authorize a pooled cross-dealer customer database.

08. Encryption, Credentials, And Secrets Protection

Compliant-ready. The data-protection design includes encryption in transit and at rest, restricted access to integration credentials and secrets, and controlled administration of associated security settings. Credentials are limited to their approved purpose. Sensitive information must not be exposed through ordinary prompts, support examples, or unrestricted operational records.

09. Infrastructure And Physical Security

Compliant-ready. Infrastructure controls address approved environments, network boundaries, restricted administration, and the allocation of responsibilities between DEOS and contracted hosting providers. Physical safeguards for hosted facilities are addressed through provider oversight. Production, development, and support activities follow their defined access and data-handling boundaries.

10. Threat Detection And Vulnerability Management

Compliant-ready. The security program addresses suspicious activity, phishing, credential compromise, malicious inputs, and exploitable weaknesses through layered controls. Monitoring, vulnerability assessment, remediation procedures, and personnel security awareness support risk reduction. Investigation and response responsibilities extend to application, integration, infrastructure, and AI-related threats.

11. Incident Response And Recovery

Compliant-ready. Incident procedures cover reporting, triage, containment, evidence preservation, impact assessment, required communications, and recovery. Events affecting dealer separation, communication permissions, or approved AI routing enter the same response process. Corrective action and controlled restoration address the underlying issue and preserve current permissions and suppression requirements.

12. Secure Development And Change Management

Compliant-ready. Development and release procedures provide for authorized changes, review, relevant testing, version control, deployment approval, and rollback or disablement planning. Material changes to code, models, prompts, connectors, retrieval, and agent tools follow risk-appropriate controls. Production dealership information remains subject to its restrictions during development and troubleshooting.

13. Vendor And Integration Risk Management

Compliant-ready. Provider and connector oversight addresses authorized access, minimum necessary data exchange, contractual restrictions, security responsibilities, incident cooperation, and termination of access. DMS, CRM, scheduling, communication, and infrastructure connections retain defined scopes. An integration permission does not grant independent provider reuse or access to another dealership's records.

14. Availability, Capacity, And Business Continuity

Compliant-ready. Availability controls address service dependencies, capacity, significant interruptions, backup handling, and recovery responsibilities. Continuity procedures preserve essential customer commitments and define fallback handling. Recovery and restoration controls maintain dealership separation and reapply current access, deletion, and communication restrictions before affected processing resumes.

15. Processing Integrity And Authorized Execution

Compliant-ready. Processing controls address authorized inputs, source authority, data mapping, completeness, timeliness, and the accurate recording of outcomes. Workflow design includes eligibility checks, duplicate prevention, controlled retries, and destination reconciliation. A generated answer, transmitted communication, confirmed booking, and completed business transaction remain distinct operating events.

16. Confidentiality And Data Lifecycle Protection

Compliant-ready. Confidentiality controls limit collection, use, disclosure, and access according to the information's purpose and sensitivity. Retention, export, disposal, and provider handling follow the applicable schedule and agreement. Protected customer content and confidential dealer intelligence are excluded from unauthorized cross-dealer use and shared-model training.

17. Privacy, Consent, And Individual Rights

Compliant-ready. Privacy controls address notices, authorized purposes, collection limits, consumer choices, individual rights requests, disclosure restrictions, and retention. Communication consent and suppression evidence remain protected. Replica and regulated biometric processing require the applicable individual authority and destruction schedule. A dealership instruction does not replace an individual's legally required consent.

18. AI Processing Boundaries And Agent Controls

Compliant-ready. AI governance limits models, retrieval, memory, and tools to approved data paths and dealership authority. Protected DDU context remains within the approved processing boundary. Agents operate through scoped tools, runtime checks, action limits, escalation routes, and stop controls. Common improvements follow controlled releases and protected-content exclusions.

19. System Description And Examination Evidence

Compliant-ready. Examination preparation organizes the system description, service commitments, infrastructure and software boundaries, data flows, personnel responsibilities, provider dependencies, and relevant controls. Evidence records are associated with control owners and the defined scope. Management's system description and assertion support the independent CPA examination and reporting process.

Supporting DEOS Policies

This readiness statement is supported by the DEOS Dealership Data Safeguards, AI Governance Policy, Privacy Policy, TCPA Compliance And Communications Acceptable Use Policy, Federal And State Regulatory summary, and applicable contractual security and processing terms. Together, they describe the protection of dealership information and the controlled operation of connected services.

Security and assurance inquiries: legal@deos1.com

Framework References

• AICPA & CIMA — System And Organization Controls: SOC Suite Of Services.
• AICPA — 2017 Trust Services Criteria, With Revised Points Of Focus — 2022.

Criteria abbreviations: CC — Common Criteria; A — Availability; PI — Processing Integrity; C — Confidentiality; P — Privacy.