Propper AI clears SOC 2 Type II and HIPAA milestones

Propper AI says it has completed an independent SOC 2 Type II audit and a HIPAA self-attestation, steps it says should make the agreement platform easier for enterprise and regulated-industry buyers to approve. The company says the work opens the door to healthcare, financial services, legal services and other customers that need stronger security evidence before adopting new software.

Why it matters: - Propper AI is trying to remove one of the biggest blockers to software adoption in regulated industries: lengthy security and compliance reviews. - The new audit and HIPAA alignment are meant to give security, compliance and procurement teams third-party evidence before approving an agreement or eSignature platform. - The company says the milestones should make Propper easier to adopt for healthcare, financial services, legal services and other regulated sectors.

What happened: - Propper AI announced completion of an independent SOC 2 Type II audit and a HIPAA self-attestation. - The SOC 2 Type II audit was conducted by Securance Pro Assurance PLLC against the AICPA Trust Services Criteria. - The observation period ended in July 2026, and the final report was issued Aug. 13, 2026. - The HIPAA work was completed earlier this year and mapped Propper's controls to the HIPAA Security and Privacy Rules. - Propper says it is prepared to enter into Business Associate Agreements with covered entities and their partners.

The details: - The SOC 2 Type II audit covered the Propper platform and supporting infrastructure. - The audit included access control and least-privilege enforcement, encryption in transit and at rest, change management, infrastructure monitoring, security alerting, vendor management and incident response. - A Type II audit evaluates whether controls operated effectively over an extended period, unlike a Type I report, which reviews control design at a single point in time. - Propper says its HIPAA controls are tracked continuously within its compliance program, rather than treated as a one-time exercise. - The company says healthcare organizations could use Propper for patient intake and consent forms, records authorizations and releases, and provider and vendor agreements while keeping PHI protected. - The full SOC 2 Type II report is available to qualified customers and prospects under NDA. - Propper AI's platform includes Gen for document generation, Fabrik for template building, Sign for e-signature, Click for clickwrap agreements and Locker for secure document storage. - The platform integrates with Salesforce, HubSpot, Google Cloud and CLEAR for biometric identity verification.

Between the lines: - Propper is positioning compliance as a sales accelerator, not just a back-office requirement. - CTO Greg Alger said enterprise buyers want evidence, not assurances, and that the company is now entering conversations with healthcare systems, financial institutions and large enterprises that were not open to a company its size a year ago. - The company is signaling that the security program is ongoing, not finished, by describing the milestones as a starting point. - For regulated buyers, the combination of SOC 2 Type II evidence and HIPAA alignment can shorten vendor reviews and reduce friction during procurement.

What's next: - Propper says it will continue its audit cycle and further strengthen its controls. - The company is likely to use the new compliance posture to pursue more enterprise and healthcare deals. - Buyers seeking the full SOC 2 Type II report can request it under NDA.

The bottom line: - Propper is betting that independent security evidence and HIPAA readiness will help it win regulated customers that need more than product claims before signing on.