Pine AI Partners with Drata to Advance SOC 2 Readiness

Pine AI has partnered with Drata to advance our SOC 2 readiness program. The engagement brings a platform for organizing audit evidence, monitoring controls, and managing policies to the security work behind Pine's AI assistants.

When you ask Pine to resolve a billing issue, follow up with a service provider, or coordinate work for your business, you are trusting it with information and permission to act on your behalf. Our work with Drata supports a practical goal: making the processes behind that trust more consistent, documented, and ready for independent review.

Why security matters for an assistant that takes action

Pine helps people get work done through calls, emails, and follow-ups. Each task creates decisions about information: what is needed, who should have access, which service needs to receive it, and what should be retained afterward.

Take a request to resolve a bill. Identifying the issue, communicating with a provider, and recording the outcome are distinct steps. Each needs a clear purpose and appropriate boundaries around the information involved.

These questions matter to individuals using Pine AI and teams exploring Pine for Business. As our assistants take on more work, our approach to access, documentation, and oversight needs to develop alongside them.

Why we chose Drata

Drata's SOC 2 platform helps teams collect evidence, monitor controls, manage policies, and collaborate with auditors. It brings those activities into a shared workspace so a compliance program can be maintained over time.

For Pine, the value is connecting security responsibilities to records that can be reviewed. An access policy, for example, needs an owner, a review process, and evidence that the reviews happened. Organizing those pieces together makes it easier to see what is in place and what still needs attention.

Drata supports that preparation. The SOC 2 examination itself is performed by an independent auditor.

Building trust with Drata.

Our first steps toward SOC 2 readiness

Our team began Drata onboarding in August 2026, with account management support and enrollment in its Compliance Accelerator Program. Since then, we have:

• Completed initial onboarding inputs: submitted our onboarding questionnaire and connected relevant third-party accounts to support readiness work.
• Started kickoff and audit coordination: begun working through initial guidance and auditor selection for our first SOC 2 examination.

The next phase focuses on clarifying the audit scope, reviewing controls and supporting evidence, addressing gaps, and preparing for the independent examination. We will share further milestones as the program progresses.

What SOC 2 means for Pine's users

SOC 2 is an examination of a service organization's controls against the applicable AICPA Trust Services Criteria. Those criteria address security, availability, processing integrity, confidentiality, and privacy, with the examination covering the categories relevant to its scope.

For Pine, the readiness process means assigning responsibility, documenting how controls work, and assembling evidence for independent review. For people considering an assistant for personal or business tasks, the aim is greater clarity about how the organization behind that assistant manages its responsibilities.

The data governance principles guiding our work

Our security page describes Pine's commitment to data minimization and purpose limitation. Our readiness work builds on the practical questions those principles raise:

• What information does the task require? A communication preference and a sensitive identifier serve different purposes. That difference should guide decisions about access, exposure, and retention.
• Who needs access, and why? Access should support a defined role or task, with clear boundaries for people, systems, and service providers.
• Who is responsible for checking the process? Policy ownership, access reviews, vendor oversight, and incident response need accountable owners and records of follow-through.
• Can users understand the explanation? People should be able to understand what an assistant needs to do a job and how their information is handled.

The compliance program gives us a structured way to examine these questions as Pine grows.

Building trust through ongoing work

Our goal is to make Pine an assistant people feel comfortable relying on for meaningful tasks. That requires useful capabilities, careful information handling, and regular review of the practices behind the product.

Working with Drata gives our team a more organized path toward independent assurance. We look forward to sharing what comes next.

For questions about privacy or how Pine handles personal data, contact privacy@19pine.ai. You can also read our Privacy Policy.

For security questions or to report a potential vulnerability, contact security@19pine.ai. Visit Security at Pine for our responsible disclosure process.

About Pine AI

Pine AI helps people and businesses delegate everyday work, including calls, emails, and follow-ups. Learn more at 19pine.ai or explore Pine for Business.