# Tillbrook Payroll Services — SOC 2 scope (agreed with the audit firm)

- Report type: **Type II**
- Observation period: **1 November 2026 to 30 April 2027**
- Trust Services Criteria in scope: **Security, Availability, Confidentiality**
- Not in scope: Processing Integrity, Privacy
- System: the Tillbrook payroll platform (web app, payroll calculation engine, client file exchange) and the people and processes that run it.
- We have **14 controls** in our control list (see controls.csv).

Note from the CEO: "While you're at it, add a GDPR mapping, and tell me straight — are we going to pass?"