Security Certifications and Audit Access

What it is

The document states that Writer holds SOC 2 Type II, HIPAA Type 1, PCI compliance, and ISO/IEC 27001, 27701, and 42001 certifications, with annual SOC 2 examinations covering Security, Availability, and Confidentiality trust service criteria.

Why it matters (compliance & governance perspective)

This provision discloses the third-party audit and certification framework Writer has implemented, which is a standard vendor due diligence reference point for enterprise procurement. The document states that SOC 2 Type II reports are available upon request to trust@writer.com, providing a defined access mechanism for audit evidence.

Consumer impact (what this means for users)

The document discloses that Writer undergoes annual SOC 2 Type II examinations and holds HIPAA Type 1, PCI, and ISO certifications. Enterprise customers can request the SOC 2 Type II report by contacting trust@writer.com.

What you can do

Institutional analysis (regulatory & governance intelligence)

1. REGULATORY LANDSCAPE: SOC 2 Type II examinations are conducted under AICPA standards and provide third-party attestation of implemented controls for Security, Availability, and Confidentiality. HIPAA Type 1 certification and PCI compliance are relevant for customers in healthcare and payment card contexts respectively. ISO/IEC 27001 covers information security management, 27701 covers privacy information management, and 42001 covers AI management systems. These certifications engage sector-specific regulatory requirements under HIPAA and PCI DSS and may interact with GDPR's requirements for appropriate technical and organizational measures. 2. GOVERNANCE EXPOSURE: Low. The described certification portfolio represents a standard enterprise security assurance framework. The key operational consideration is confirming that the scope of each certification covers the specific Writer services and data types used by the enterprise customer. 3. JURISDICTION FLAGS: HIPAA-covered entities and business associates should confirm that Writer's HIPAA Type 1 certification scope covers their specific use case and that a Business Associate Agreement is in place. EU customers should assess ISO 27701 certification scope as evidence of privacy information management controls relevant to GDPR Article 32 obligations. 4. CONTRACT AND VENDOR IMPLICATIONS: Procurement teams should request the full SOC 2 Type II report via trust@writer.com and review the scope, trust service criteria covered, and any exceptions noted by the auditor. The HIPAA certification type and PCI compliance scope should be confirmed against the specific data flows and services used. ISO certificate validity and scope should be independently verified. 5. COMPLIANCE CONSIDERATIONS: Organizations subject to third-party vendor risk management requirements should obtain and review the SOC 2 Type II report on an annual cycle aligned with Writer's examination schedule. HIPAA-covered entities should confirm Business Associate Agreement terms in conjunction with the HIPAA Type 1 certification. PCI DSS-affected customers should confirm the scope of Writer's PCI compliance relative to any payment card data that may transit the platform.

Applicable agencies

Provision details

Other risks in this policy

• Administrative technical physical organizational security measures medium
• Agent requests pass through governed execution layer medium
• User right to opt out of targeted advertising cookies medium
• Customer-configurable automated data deletion schedule high
• Customer owns all data and outputs high
• Data encrypted at rest and in transit high