Medilee has a SOC 2 Type 2 report. Here is what that actually means for your data.
Medilee has been issued a SOC 2 Type 2 attestation report by Sensiba, covering the Security, Availability and Confidentiality Trust Services Criteria. We are also certified to ISO/IEC 27001:2022.
When we wrote about our ISO/IEC 27001 certification, and we said plainly that our SOC 2 Type 2 examination was still in progress. It is now finished. Sensiba, an independent CPA firm, has issued Medilee a SOC 2 Type 2 attestation report, with its signed opinion dated 25 October 2026.
That closes the one gap we flagged last time. It also deserves the same treatment we gave ISO 27001: a clear account of what the report shows, what it does not, and how to use it if you are the one doing the due diligence.
What the report covers
A SOC 2 report is not a single pass or fail. It is defined by its scope, and the scope is the first thing a careful reader should check. Ours is:
- The system: the Medilee software as a service platform, which is where your referral files, case summaries and drafts live.
- The criteria: three of the AICPA's five Trust Services Criteria. Security, which every SOC 2 report includes, covers protection against unauthorised access. Availability covers whether the system is operated and monitored so it is there when you need it. Confidentiality covers how information designated as confidential is protected through its life, including disposal.
- The period: 1 March 2026 to 31 May 2026. The auditor tested whether our controls operated effectively across those three months, not just whether they existed on one day.
We did not include the Processing Integrity or Privacy criteria in this report. How we handle personal information is set out in our privacy policy, which remains the document that governs it.
Why Type 2 is the one that counts
The difference between Type 1 and Type 2 is the difference between a photograph and a recording. A Type 1 report, which we already held, assesses whether controls are suitably designed at a single point in time. A Type 2 report assesses whether those controls actually operated effectively across a period.
In practice that means the auditor typically does not just read the access control policy. They sample real events from the period and check them: whether people who left had their access removed on time, whether changes to the platform went through review, whether access was reviewed when it was supposed to be, whether monitoring alerts were followed up. A control that only works on audit day does not survive that kind of testing.
A Type 1 report shows the controls were designed properly. A Type 2 report shows they kept working when nobody was preparing for an audit.
That is why procurement teams, insurers and larger practices increasingly ask for Type 2 specifically. It is evidence about behaviour over time, which is what you are actually relying on when you hand over a file.
How it fits with ISO 27001
We now hold both, and they do different jobs. ISO/IEC 27001 certifies the information security management system across the organisation: that risks are identified, treated, owned and reviewed, with an external auditor returning every year. SOC 2 is an attestation report, not a certificate, written by an auditor about a defined service. It tests whether specific controls in that service worked over the period examined.
Put simply, ISO 27001 tells you the system for managing security is properly governed. SOC 2 Type 2 tells you the controls in the platform your files sit on were tested and held up. A specialist or practice manager assessing a vendor gets more from the two together than from either on its own.
What the report does not mean
The same honesty about limits applies here.
- It is a report about a past period. The opinion covers 1 March to 31 May 2026. It is strong evidence about how we operate, but it is not a guarantee about every day since. That is why SOC 2 reports are renewed periodically, and why the period covered is worth checking on any report you are given.
- It says nothing about clinical accuracy. SOC 2 assesses security, availability and confidentiality controls. It does not assess whether a case summary is right or a draft is faithful to the file. That is what source-linking and your own review are for.
- It does not transfer your obligations. Under Australian Privacy Principle 11 you still need to take reasonable steps to protect the health information you hold. Our report is evidence for your due diligence, not a substitute for it.
- It does not mean zero risk. No system is unbreachable. What the report shows is that the controls meant to reduce and detect risk were in place and working when tested.
How to get the report
The full SOC 2 Type 2 report contains the auditor's opinion, a description of the system, and the controls tested along with the results. Like most SOC 2 reports, it is not published in full, because it describes our security controls in detail. You can request it through our Trust Centre, alongside our ISO/IEC 27001 certificate.
If you are reading any vendor's SOC 2 report, including ours, three things are worth checking first: whether it is Type 1 or Type 2, which Trust Services Criteria are in scope, and whether the period it covers is recent. Then read the auditor's opinion and look for any exceptions noted against the controls.
The point of all of this
Medilee's design principle is that you form the opinion and we handle everything around it. Handling everything around it includes being trustworthy with somebody's medical history. When we finished the ISO 27001 audit, we said you should not have to take our word for how your files are protected. With the SOC 2 Type 2 report, you now have an independent auditor's account of those controls working over time, not just on paper.
