# CovenantIQ

Automated covenant monitoring

Research: https://www.safecli.org/company/covenantiq.io
Company: https://covenantiq.io

## Evidence status

Insufficient enterprise evidence
Source review: 2026-10-16T03:30:20.747Z
API: Unknown

Company-published claims, not independently verified controls. Unknown is not evidence of absence.

## Procurement checks

### Security assurance — Mixed claims — review

> ## SOC 2 Type II Certified

Source: https://covenantiq.io/
Reviewed: 2026-10-16T03:30:20.747Z

> CovenantIQ is certified SOC 2 Type II by independent audit and assessment by Prescient Assurance.

Source: https://www.covenantiq.io/security
Reviewed: 2026-10-16T03:30:20.747Z

> CovenantIQ has achieved SOC 2 Type II certification through independent audit by Prescient Assurance — covering security, availability, and confidentiality controls across every layer of the platform.

Source: https://covenantiq.io/
Reviewed: 2026-10-16T03:30:20.747Z

> We've achieved SOC 2 Type II certification through independent audit by Prescient Assurance — covering security, availability, and confidentiality controls across every layer of the platform.

Source: https://www.covenantiq.io/security
Reviewed: 2026-10-16T03:30:20.747Z

- [ ] Request the current audit report, scope, exceptions and expiry; confirm the vendor entity.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### SSO & provisioning — Not found


- [ ] Test SSO enforcement, user removal and privileged-account recovery.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Access controls — Not found


- [ ] Test least-privilege roles and cross-tenant access with separate test accounts.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Auditability — Company-published

> Automate scheduled reporting covenants with configurable cadence, borrower attestation workflows, and a complete audit trail — so nothing falls through the cracks.

Source: https://covenantiq.io/
Reviewed: 2026-10-16T03:30:20.747Z

> Automate scheduled covenant submissions with configurable cadence, borrower attestation workflows, and a complete audit trail — so nothing falls through the cracks.

Source: https://www.covenantiq.io/product
Reviewed: 2026-10-16T03:30:20.747Z

- [ ] Verify administrative and data-access events, retention and export.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Data handling — Not found


- [ ] Review DPA, subprocessors, retention, deletion, residency and AI training use.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Reliability & support — Company-published

> Our documented incident response plan is tested each year through tabletop exercises, ensuring we are ready to detect, contain, and resolve issues if they arise.

Source: https://www.covenantiq.io/resources/security-and-data-stewardship-at-covenantiq
Reviewed: 2026-10-16T03:30:20.747Z

> Built-in redundancy across regions and availability zones, strong disaster recovery options, and high uptime ensure we can reliably handle large volumes of financial data.

Source: https://www.covenantiq.io/resources/security-and-data-stewardship-at-covenantiq
Reviewed: 2026-10-16T03:30:20.747Z

- [ ] Request SLA, incident history, recovery targets and support escalation terms.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

### Product effectiveness — Not found


- [ ] Run a representative pilot against your current workflow; measure errors, missed cases, time saved and human review cost.
- [ ] Record reviewer, test date, scope, result and supporting artifact.

## Decision

- Owner:
- Intended use and data sensitivity:
- Blocking requirements:
- Pilot success criteria:
- Unresolved risks:
- Decision and review date: