Your outside counsel invoices contain more than hours and rates. They include party names, legal strategy, staffing decisions, and sensitive business activity. Your Outside Counsel Guidelines describe how your organization manages those relationships. Neither belongs in a tool you have to trust on promises alone.
42B is now SOC 2 Type I compliant! This is an important milestone in how we earn the confidence of the legal departments we serve—and a foundation for the work that comes next. Our SOC 2 Type II certification remains in process.
What SOC 2 compliance actually means
SOC 2 is an independent examination of a service organization's controls against applicable Trust Services Criteria developed by the American Institute of Certified Public Accountants (AICPA).
A Type I report evaluates the design of controls at a specific point in time. A Type II report also evaluates the controls' operating effectiveness over a period of time (usually 3-12 months). That distinction matters: our Type I milestone today should be read as an indicator that from its inception 42B has been security minded. We are now actively working with auditors during the observation window to test and improve our security controls to ensure their effectiveness over time and deliver the most secure product possible to you.
For 42B, this milestone means our commitment to security is backed by independent examination, rather than simply statements on a website.
Why this matters to your legal team
In-house legal teams want faster invoice review and better billing compliance. They also have to answer an equally important question: can we trust this partner with our information?
Today's SOC 2 Type I announcement gives teams the strongest possible starting point.
- Evidence for vendor due diligence. Your security, procurement, and legal teams can assess an independently examined control framework instead of relying only on a vendor questionnaire or sales presentation.
- A clearer basis for risk decisions. Instead of only reading auto-generated responses to security questionnaires, your cybersecurity teams trust SOC 2 compliance standards and attestations.
- Accountability beyond the product. A useful AI reviewer is only part of the relationship. The organization behind it must take responsibility for how it handles the information entrusted to it. 42B is committed to earning your trust line by line, invoice by invoice.
This does not remove the need for your review. It makes that review more informed.
Better billing compliance should not come at the expense of trust
42B helps legal departments check outside counsel invoices against their own guidelines. That work depends on information clients are right to protect.
Our position is straightforward: we never train AI models on customer data. We are also compliant with GDPR and CCPA. These are separate commitments; SOC 2 does not itself certify compliance with privacy laws, and we do not present it that way.
Your team should be able to ask direct questions about security, privacy, and data handling before sharing guidelines or invoices. A trusted partner welcomes those questions and supports the review—not just the purchase.
Why this is good for the legal technology industry
AI is changing what legal departments can expect from invoice review. It should also raise what they expect from the companies providing it.
Independent examination helps move the industry beyond vague assurances that a tool is “secure." It creates a more substantive conversation about evidence, scope, accountability, and the limits of any assurance. Your base model LLMs and agents that you've been running basic invoice reviews on can't always meet the SOC 2 standards.
Having SOC 2 compliance benefits buyers and responsible vendors alike. Legal departments get a more consistent way to ask hard questions. Technology providers have an incentive to demonstrate their commitments rather than rely on polished claims.
The standard should not be innovation or trust. Legal teams deserve both.
A milestone, not a finish line
SOC 2 Type I is a meaningful step forward for 42B. Our SOC 2 Type II certification is still in process, and an Auditor Engagement Letter is available upon request.
We are proud of this milestone because it supports the kind of partnership we want to build: clear about what we have achieved, honest about what remains underway, and focused on the responsibilities that come with handling client information.
Trust is not a badge we ask you to accept. It is something we intend to keep earning.
Start your security review
To get your security review started, contact legal@42B.ai. We can discuss your review requirements and provide the Auditor Engagement Letter for our Type II work upon request.
You can also visit our Security section, read our Privacy Policy, or learn how Outside Counsel Guidelines support better invoice review.
