Propane has completed its SOC 2 Type II audit, conducted by Insight Assurance. The report covers December 10, 2025 to March 9, 2026, with a clean opinion — no exceptions noted across any control tested, and no security incidents during the examination period. You can request the report at trust.usepropane.ai.

Type II is a step up from Type I, which only attests that controls exist at a single point in time. Type II is an attestation that we operated those controls effectively over a sustained period. Propane connects to your CRM, support tools, product analytics, and the rest of your customer data stack to give Product, GTM, and CX teams a shared source of truth. We sit in the middle of a lot of customer data, and you should know how we handle it.

The audit covers the Security trust services category for the Propane Customer Intelligence Platform and API. Customer data is encrypted at rest with AES-256 and in transit over TLS 1.2+. Access is role-based and least-privilege, with MFA enforced on production systems, source code, and admin panels, reviewed quarterly and revoked within 48 business hours of termination. Production changes are documented, tested, reviewed, and approved before deployment. Continuous vulnerability scanning runs alongside annual third-party penetration testing, with intrusion detection, log management, and infrastructure monitoring across production. Incident response and BC/DR plans are tested annually. We host on Google Cloud Platform and Vercel, both SOC 2 attested and reviewed annually as part of our vendor program.

For European customers: customer data stays in EU regions on GCP, and a DPA is available on request.

If you're in the middle of a security review with us, this should make procurement faster. SOC 2 isn't a finish line — the controls stay in place, annual audits continue from here, and ISO 27001 is on the roadmap next. For procurement questions, email security@usepropane.ai.