What is SOC 2?
A 'SOC 2 compliant' line on a website tells you little. The report says what was checked, on which systems, and over what dates.
Want to see it first? Book a demo
SOC 2 — SOC 2 is an audit report, issued by an independent CPA firm, on a service organisation's controls for security, availability, processing integrity, confidentiality and privacy over a period. It is evidence about the vendor's controls, not a certification of the product.
Why it matters
SOC 2 is a report, not a badge. An outside CPA firm checks a vendor's controls against a set list of trust service criteria. Those can include security, availability, processing integrity, confidentiality and privacy. The firm then writes up what it found over a set period. The report shows how well the controls were built. A Type II report also shows whether they worked over that period. It's not a one-time stamp that holds forever.
When you judge a vendor, the key split is between the company and the product. A SOC 2 report speaks to the company's controls: who gets access, how changes ship, how it handles incidents, and how it watches its systems. It doesn't say a given product is free of bugs. A website line that says "SOC 2 compliant" can't be checked from that sentence alone. The report itself lists which trust criteria were in scope, which systems it covered, and the exact dates. Any of those can be narrower than the website line makes it sound.
How a SOC 2 report comes about
- 1
Trust criteria are scoped
The company picks which criteria (security, availability and others) the audit will cover.
- 2
Controls are built and written down
Policies and technical checks for those criteria are put in place.
- 3
An outside CPA firm examines them
The firm checks whether the controls are built well.
- 4
The controls are tested over time
For a Type II report, the firm checks whether the controls worked over that period.
- 5
A report is issued
The findings, scope and dates are written up in the final report.
The mistake to watch for
Questions
- How is SOC 2 different from ISO 27001?
- SOC 2 is an audit report against trust service criteria, common in the US and issued by a CPA firm. ISO 27001 is a global certificate against a formal standard for running information security. An approved certification body issues it, with a different scope and process.
- Does SOC 2 certify a specific product?
- No. It reports on the company's controls, such as who gets access and how it handles incidents, over a set period. It doesn't say any single product is free of defects.
- What should someone ask for beyond the claim of SOC 2 compliance?
- Ask for the report itself. It states which trust criteria were in scope, which systems it covered, and the exact dates. A broad claim on a website can be narrower than it sounds.