We want to share an update on where things stand with our compliance program following the Delve situation.
Over the past two weeks, we've moved quickly but deliberately to re-establish our compliance verification from the ground up.
We've formally engaged Drata as our new compliance automation platform, replacing Delve. Drata is used by companies like Wiz, LinkedIn, and Brex, and gives us continuous, automated monitoring of our security controls.
For the audit itself, we've signed an engagement letter with A-LIGN, the leading SOC 2 auditor globally, with over 31,000 audits completed across 5,700+ clients including US Bank and Snowflake. Before signing, we evaluated multiple audit firms, vetted their methodologies, confirmed their US-based operations, and assessed their independence from our GRC platform.
A-LIGN will be reverifying our SOC 2 compliance and verifying our HIPAA status. In addition, ISO 27001 certification is in progress with A-LIGN. We expect to have the SOC 2 audit completed in roughly eight weeks, possibly sooner.
We are not rushing this process. The entire reason we're here is because a vendor cut corners on verification. We're not going to emulate that mistake. We've asked our partners to minimize any administrative lag time, but we've been explicit that we don't want anyone—ourselves included—to sacrifice rigor for speed. The integrity of this report matters more than the timeline.
Our security controls (MFA, SSO, MDM, endpoint detection, encryption, role-based access, audit logging, and more) have been independently reverified and remain fully operational. The question was never whether our controls exist; it was whether they were properly verified. That's what we're fixing.
If you have questions, reach out to security@wispr.ai. We'd rather overcommunicate than leave anyone guessing.
Start flowing
We’re hiring the best people who care about what they work on, and care about having fun.
