Ninety-four pages. That is the length of the SOC 2 Type II report my exchange publishes, and I read all of it during the first week of April, mostly between 10 and 11 pm on the couch with the PDF at 140 percent zoom. The audit window runs October 1, 2024 thru September 30, 2025. The document was written by an accounting firm I had never heard of, for readers who live in procurement departments. I am not one of those readers. I have $6,400 sitting on the exchange.
The $6,400 is deliberate — it is the working slice that feeds my weekly buys, while the rest lives on hardware in a closet. Deliberate is not the same as blind, though. The exchange's marketing page says security is our top priority, which is a sentence with no content and no way to be wrong. The SOC 2 report is the opposite kind of document: dated, sampled, signed, and boring in ways that can be checked. So I checked.
An ordinary customer can verify more in that PDF than I anticipated, and less than the trust-center page implies. Five claims confirmed against my own account history. Three stayed outside my reach no matter how slowly I read. Page 61 alone justified the entire evenin'.
the footer link and the two-day wait
The report hides behind a trust-center link in the site footer. Not in any help article. The request form asks for a business email, technically, and mine is a personal address on my own domain. The click-through license — personal use only, do not redistribute — unlocked the download two days later, and the sales call I had braced for, complete with a rehearsed hang-up script, never came.
Type I versus Type II, one paragraph
Type I says the controls existed on a given day, a photograph of a gym membership. Type II says the controls operated over the entire period, evidenced with sampled transactions across the October-to-September window rather than a single inspected day, which is the difference that matters. The auditor's opinion sits on page 4, six paragraphs of deliberately stiff language. The conclusion: controls were effective throughout the period, with exceptions noted. Exceptions noted. That phrase sent me to the table of contents, and the table of contents sent me to page 61.
the exceptions table on page 61
Two exceptions, both with remediation dates. The first: quarterly access reviews for one internal system ran 40 days late in the second quarter. The second: two of 65 sampled offboarding cases kept a departed contractor's tool access alive for 11 extra days past termination, discovered by sampling rather than by anyone noticing in real time. Neither touches customer funds directly, and both carry closure notes — reviews completed October 12, tool access revoked the day it was found. I wrote both dates in my own notebook next to my own records, because a remediation you can timestamp beats a promise you cannot.
the asterisk farm, aka subservice organizations
Page 28 lists the carve-outs: a cloud host, a KYC vendor, an email platform, a data-center operator. The exchange's controls stop where those companies begin, and the auditor tested only the handoff points between them. My deposit's safety leans partly on infrastructure the report never describes, run by companies with whom I have no contract and toward whom I owe exactly zero diligence. Every SOC 2 report has this asterisk farm. The marketing page does not mention it, and the asterisks mark the true border of the promise.
five claims I could check from my couch
Flat list, each one verified against my own account. One: the report states withdrawals to newly added addresses wait a cooldown of 24 to 72 hours, and my own address addition last May waited exactly 72, to the hour. Two: new-device logins trigger email alerts — eleven of 'em sit in my archive with intact timestamps. Three: identity verification gates account changes — a 2024 name-correction ticket demanded two document types, and the ticket history still shows it. Four: the retention table promises seven years of withdrawal records — my 2019 records still export, all of them. Five: encryption in transit — I checked the certificate chain myself, current and clean. Five for five, all verified from a couch.
three things the PDF never says
How much customer crypto sits in cold storage: not in there. Whether reserves match liabilities: that lives in a separate proof-of-reserves attestation, different scope, different date, and the two documents share a cover page and almost nothin' else. Whether any employee can view my individual balance: the report covers logical access in the abstract, and the actual permission list attached to my account row is not a document any customer can read. I asked support all three questions. Two answers restated the marketing page. The third came back with a number and no way for me to test it, which I noted as a fact rather than a comfort.
the evening, priced
Total cost: one 94-page PDF and three hours spread across four nights. Zero dollars. Total value: I now know exactly where the promise ends — at the asterisks, at the cold-storage claim I cannot audit, at the trust I extend to an accounting firm I will never meet. The $6,400 stays put on the same terms as before. The difference is that I have read the terms. That is what the PDF was for.
page 61, one more time
April 7, 10:40 pm, couch, highlighter, and I reread the exceptions table once before closing the laptop. Both found, both fixed, both dated. Reading the report did not make the exchange safe. It made the word safe specific enough to argue with, which is more than the marketing page managed across five years of homepage redesigns and annual security blog posts. That is the whole exercise.
