Is this your company? Buyers are checking Income Lab here. Claim incomelaboratory.com free to control the listing, earn the badge buyers trust, and see who's evaluating you.
Claim free
Income Lab
Trust level
Listed
Unverified
Listed
Domain
Report
Live
Sourced from public information. Not yet verified by the company.
Income Lab is SOC 2 Type II compliant.
About
Income Lab is a retirement-planning software that helps advisors deliver dynamic, personalized retirement distribution plans. It offers tools for Social Security optimization, tax-smart withdrawals, annuities, and ongoing plan adjustments, empowering confident client decisions and improving retirement outcomes. Schedule a Compliance Meeting - https://calendly.com/d/ctbz-fww-vrc/compliance-demo
Compliance & infrastructure
Compliance leadership
The person who leads Income Lab's SOC 2 isn't listed yet. Claim this profile to add it.
Penetration test
Unknown. Income Lab's penetration test vendor isn't listed yet.
Claim this profile to add it.
This listing is partial
3/11 details · 27%SOC2C shows the verified essentials. 8 details are not yet provided by the company. Trust centers list more, so we invite the owner to fill the gaps here.
- Auditorraises trustAdd the CPA firm that issued your SOC 2 so buyers can verify who signed it.
- Report dateraises trustAdd your most recent report period so buyers see how current your SOC 2 is.
- Renewal dateAdd your renewal window so buyers know your coverage is active.
- Other certificationsList your other frameworks (ISO 27001, HIPAA, PCI DSS) the way your trust center does.
- DocumentsList the documents you share (SOC 2 report, SOC 3, pen-test summary, DPA) and whether each is public or on request.
- SubprocessorsList your subprocessors so buyers can assess fourth-party risk, the way your trust center does.
- HostingAdd where you host (AWS, GCP, Azure) and data residency.
- Security controlsConfirm key controls (encryption, MFA/SSO, annual pen test, BCP/DR) buyers screen for.
Claim free to control your listing
Verify your work email to take ownership, earn the badge buyers trust, and add the details that win deals.
Frequently asked
Is Income Lab SOC 2 compliant?
Income Lab is SOC 2 Type II compliant. On SOC2C this listing is Listed.
Is Income Lab SOC 2 Type I or Type II?
Income Lab is SOC 2 Type II compliant. A Type II report covers how security controls operated over a period (typically 3 to 12 months), a stronger signal than a point-in-time Type I.
Can I use Income Lab's SOC 2 for a vendor risk assessment?
Yes. Income Lab's SOC 2 status, frameworks, auditor, and renewal timing are on SOC2C for vendor risk and security reviews. Request the underlying report through SOC2C to complete your third-party risk file.
Is Income Lab penetration tested?
Income Lab hasn't listed its penetration testing on SOC2C yet. SOC 2 Type II programs typically include periodic third-party penetration tests; the company can add who performed theirs.
Is Income Lab secure?
Security isn't a single yes/no, but Income Lab is SOC 2 Type II compliant. SOC2C verifies its compliance posture and shows how strongly each fact is proven.
Does Income Lab have a bug bounty or vulnerability disclosure program?
Income Lab hasn't listed a bug bounty or vulnerability disclosure program on SOC2C. Many companies accept security reports at security@incomelaboratory.com or via a /security page (Income Lab lists a security contact).
Who are Income Lab's subprocessors?
Income Lab's subprocessors aren't listed on SOC2C yet. The company can add them so buyers can assess fourth-party risk.
Where does Income Lab host or store data?
Income Lab's hosting and data-residency details aren't listed on SOC2C yet. The company can add where it hosts (AWS, GCP, Azure) and which data it handles.
Where is Income Lab's trust center or security page?
Income Lab's trust center is at https://trust.incomelaboratory.com. Its verified SOC 2 status, frameworks, and documents are summarized on its SOC2C profile.
Answers published by Income Lab
Reproduced from Income Lab's own trust center. These are the company's statements about its security practices — SOC2C has not tested or verified them, and they may have changed since we last read the page. Check the source ↗
How does Income Lab handle hypothetical performance?
Income Lab does not generate hypothetical performance for specific investments or securities. Instead, it uses high level capital market assumptions across broad asset classes, consistent with standard financial planning practices. All projections are assumption driven and not indicative of actual portfolio performance
What client data does Income Lab collect?
Income Lab collects minimal personally identifiable information (PII) necessary for financial planning: - Name - Date of birth (month and year only) - State of residence - Email address (only if client portal access is enabled) No account numbers or Social Security numbers are collected or stored.
How does Income Lab protect client data?
Income Lab encrypts all data in transit and at rest, consistent with industry standards. Income Lab does not store or display raw account numbers.
Does Income Lab integrate with custodians and data providers?
Yes. Income Lab integrates with custodians such as Schwab and data aggregation platforms like Envestnet | Yodlee, as well as portfolio reporting systems like BlackDiamond, Orion, and BlueLeaf, and CRMs like RedTail. These integrations securely transmit account balances and related financial data while maintaining full compliance with data-handling standards.
Can clients access their financial plans?
Client portal access is optional and controlled by the advisor. Advisors can invite clients with one of three access levels: - Aggregator-only (data sync only) - View only - View and edit Advisors may modify or revoke access at any time.
Does Income Lab allow chat or document sharing?
No. The platform does not include chat or file sharing functionality.
What disclosures are included in Income Lab reports?
Income Lab provides PDF reports with standard disclosures. These reports include language clarifying that: - Projections are not actual performance. - Reports are not a replacement for custodial statements. - Results may differ due to market conditions or assumption changes. Furthermore, firms can upload their own disclosures to be placed at the end of all produced reports. The Income Lab team can provide a clean FINRA letter related to our reports if requested.
Does Income Lab store any client data outside of the United States?
No. All client data is securely stored within the United States. We do not use offshore or international data storage locations, ensuring that all information remains protected under U.S. data privacy and security standards.
Do you train large language models (LLMs) on client data?
No. Client data is never used to train LLMs. Our AI models are not trained on any client information, ensuring your data remains private and secure.
How does Income Lab AI use my data?
Our AI tools only operate on data that the signed-in user already has permission to view. We strictly honor your firm’s roles, entitlements, and sharing settings, ensuring no one gains access to data they shouldn’t see.
How does Income Lab minimize data exposure?
We use data minimization by design, meaning only the minimum necessary data is sent to AI components for processing. This reduces risk and protects sensitive customer information.
Is AI activity monitored for compliance?
Yes. All AI activity is continuously logged and monitored. Automated systems detect and alert on any suspicious behavior to ensure compliance and transparency.
