Compliance and Attestations

SOC 2 Type 2

Comma has engaged a CPA firm to perform a SOC 2 Type 2 examination under AICPA AT-C Section 205. The examination is in progress and covers the Security, Availability, and Confidentiality Trust Services Criteria over a 3-month observation period.

A signed SOC 2 Status Letter confirming the engagement and current state is available under mutual NDA. Following issuance of the Type 2 report, we provide post-issuance bridge letters on the standard cadence at customer request.

SEC Rule 17a-4 (Books and Records)

The Comma platform is designed to support customer compliance with SEC Rule 17a-4(f), the WORM-compliant electronic recordkeeping requirement applicable to broker-dealers.

WORM storage: All archived content is written to Microsoft Azure immutable storage with a locked retention policy. Versioning is enabled. Public access is blocked.
Application separation: The Rails application never writes directly to archival storage. Archive writes are mediated by a dedicated sink connector whose access is limited to adding new records; delete and retention-change operations are explicitly denied by policy.
Immutability: Once written, archived content cannot be altered or deleted by any user role, including Comma personnel, for the duration of the retention period.

FINRA Rule 4511

Archived records are immutable and kept for 6 years by default, configurable per customer regulatory requirement. The 6-year default is a platform setting, not a regulatory period. FINRA Rule 4511 and SEC Rule 17a-4 set a 6-year period for many broker-dealer records, and customers subject to a different period configure retention to match it. Combined with the supervisor-designation and supervisory-review workflows in the Comma dashboard, this supports customer compliance with FINRA’s books-and-records obligations.

MiFID II and FCA SYSC 10A

The platform captures communications across in-scope channels (WhatsApp, Signal, iMessage, Telegram, voice via integration partners, etc.) and writes them to immutable storage with retention configurable to meet the longest applicable regulatory window. Customers determine which personnel and channels are in scope.

Data Processing Agreement (DPA): Available, consistent with GDPR Article 28.
Per-tenant data segregation: Enforced at the application layer.
EU residency: Available on enterprise request, requiring a dedicated environment in Azure EU and AWS EU regions. See Data residency.
Data subject rights: Comma supports customer-initiated export. Deletion requests are subject to the underlying regulatory retention obligation - archived content under a books-and-records retention hold cannot be deleted on customer request alone.
EU DPO contact: Available on request.

HIPAA

Comma is available for healthcare customers under a Business Associate Agreement (BAA). The BAA must be executed before storing PHI in the platform. Customer-specific configuration may be required to meet specific HIPAA Security Rule provisions.

Google CASA (Workspace Marketplace OAuth)

Comma undergoes an annual assessment under the Google CASA program (Cloud Application Security Assessment) - Google’s required security assessment for apps published on the Workspace Marketplace. CASA covers OAuth integration security and a defined set of application security controls. The assessment is performed by an Authorized Lab. Most recent authorized assessment: March 31, 2025. The 2026 cycle was submitted in April 2026 and is currently in review.

ISO 27001

ISO 27001 certification is in progress. We are currently undertaking ISO 27001 certification. A signed engagement letter confirming the program is available under mutual NDA.

What we do not currently have

For transparency, the following are not in our current posture:

PCI DSS - not applicable. Comma does not process, store, or transmit cardholder data.
FedRAMP - not currently authorized. We do not currently sell to U.S. Federal agencies.

If your procurement process requires a posture we don’t currently hold, please contact us - we are happy to discuss roadmap and timing.

Document requests

Available under mutual NDA:

NDA edition of the Trust Whitepaper
SOC 2 Status Letter (in-flight examination)
ISO 27001 Engagement Letter (certification in progress)
Subprocessor register with named providers
Standard DPA, BAA

Contact: Zeeshan Gulzar, Head of Technology - zeeshan@commacompliance.com

You can also visit our Trust Center for additional security and compliance documentation.