I have spent more than 15 years building and working with electronic signature and agreement technology. One thing has stayed consistent throughout that time: trust matters just as much as product functionality.
Agreements contain some of the most sensitive information a business handles. Contracts, offer letters, patient consents, financial documents, vendor agreements, and signed records all carry business, legal, and compliance significance.
When customers use Propper to create, send, sign, and store those agreements, they are trusting us with more than a workflow. They are trusting us with the systems, data, and audit trail behind important business transactions.
That trust should be backed by evidence.
Today, I am proud to share that Propper has completed a SOC 2 Type II examination by an independent CPA firm.
What Is SOC 2 Type II?
SOC 2 is an independent examination framework developed by the American Institute of Certified Public Accountants, or AICPA, for evaluating controls at technology and service organizations.
A SOC 2 Type II examination evaluates both how controls are designed and how effectively they operate over a defined period of time.
That distinction is important.
A Type I report looks at whether controls are properly designed at a specific point in time. A Type II report goes further by reviewing evidence that those controls actually operated over an extended period.
From a technical perspective, this means an auditor is not simply reviewing policy documents. They are examining the underlying processes and evidence that show those policies are being followed in day-to-day operations.
For customers, that provides a much stronger signal about how a company actually runs its security program.
What Propper Completed
Propper completed a SOC 2 Type II examination conducted by Securance Pro Assurance PLLC, an independent, licensed audit firm.
The examination evaluated our controls against the AICPA Trust Services Criteria over a multi-month observation period ending in July 2026. The final report was issued on August 13, 2026.
The examination covered controls across the Propper platform and supporting infrastructure, including areas such as:
- Access control and least-privilege enforcement
- Encryption in transit and at rest
- Change management
- Infrastructure and system monitoring
- Security alerting
- Vendor management
- Incident response
These are not abstract compliance concepts. They are the operational controls behind how we build, deploy, monitor, and protect Propper.
For example, least privilege means engineers and systems should only have access to what they need. Change management means production changes follow defined review and deployment processes. Monitoring and alerting means we have systems designed to identify unusual activity or operational issues so they can be investigated quickly.
SOC 2 Type II provides independent evidence that these controls were not simply documented. They were operating during the examination period.
What SOC 2 Type II Means for Propper Customers
If You Are Evaluating Propper
Security reviews are a normal part of selecting an agreement or eSignature platform.
Over the years, I have seen these reviews become significantly more detailed, especially for companies operating in regulated industries or handling sensitive customer information.
A SOC 2 Type II report gives your security, compliance, and procurement teams independent evidence they can review as part of that process.
Instead of relying only on our answers to security questionnaires, customers can review the findings of an independent audit firm.
The full Propper SOC 2 Type II report is available to qualified customers and prospects under NDA. Contact us to request a copy.
If You Are Already a Propper Customer
Your day-to-day experience does not change.
That is actually a good thing.
The controls evaluated during the examination are part of the systems and processes we already use to operate Propper. The report provides independent validation around how those controls operated during the review period.
Security should not be something a company turns on for an audit. It should be built into how the product and infrastructure operate every day.
That is the standard we are working toward at Propper.
If You Work in a Regulated Industry
For companies in healthcare, financial services, legal services, and other regulated industries, vendor security and compliance reviews are often a significant part of adopting new technology.
SOC 2 Type II gives those teams independent evidence around the controls supporting the Propper platform.
Earlier this year, we also announced our HIPAA-ready posture for healthcare. Our SOC 2 Type II examination builds on that work and provides additional third-party validation around our broader security and compliance program.
The goal is simple: make it easier for customers to understand how Propper protects their data and provide the evidence their security teams need to make an informed decision.
Why This Matters in eSignature
After more than 15 years in the eSignature industry, I have seen the technology evolve from a replacement for handwritten signatures into a core part of business infrastructure.
Today, electronic signature platforms sit in the middle of critical business processes.
They handle identity, consent, documents, routing, audit evidence, and long-term records. In many cases, they also integrate directly with CRM systems, financial systems, healthcare systems, and other applications that contain sensitive data.
Because of that, security cannot be treated as a feature.
It has to be part of the architecture.
That includes how users authenticate, how services communicate, how documents are stored, how data is encrypted, how production access is controlled, how changes are reviewed, and how events are logged and monitored.
A strong user experience is important. Reliability is important. Pricing is important.
But none of those matter if customers cannot trust the platform handling their agreements.
SOC 2 Type II is one way we can provide independent evidence behind that trust.
Security Is an Operating Standard
A SOC 2 Type II report covers a defined examination period, but the underlying security program continues every day.
The controls evaluated during the examination are part of our ongoing engineering and compliance processes. That includes automated monitoring across infrastructure, access, endpoints, and production systems.
For me, this is the most important part of SOC 2.
The report itself matters, but the real value is the operational discipline behind it.
Security controls are most useful when they become part of normal engineering work instead of a separate compliance exercise.
That means building security into software development, infrastructure changes, access management, monitoring, incident response, and vendor management.
We built Propper to give teams a modern agreement platform that is fast, flexible, and transparently priced. We also want customers to understand exactly how we approach the security of the systems behind it.
SOC 2 Type II gives us independent evidence that supports that commitment.
This is an important milestone for Propper, but it is not a finish line. We will continue our examination cycle, strengthen our controls, and keep investing in the security and compliance program behind the platform.
Request Propper's SOC 2 Type II Report
Security, compliance, and procurement teams can request the full Propper SOC 2 Type II report under NDA.
You can also explore Propper and Propper Sign, or book a demo to talk with our team about your eSignature, agreement, security, and compliance requirements.