SOC 2 Type 2

Alembic is responsible for its service commitments and system requirements and for designing,
implementing, and operating effective controls within the system to provide reasonable assurance
that Alembic’s service commitments and system requirements were achieved. Alembic has also
provided the accompanying assertion about the effectiveness of controls within the system. When
preparing its assertion, Alembic is responsible for selecting, and identifying in its assertion, the
applicable trust service criteria and for having a reasonable basis for its assertion by performing an
assessment of the effectiveness of the controls within the system. Full SOC2 report is available under NDA