Start for free Start for free

SOC 2

SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe.

What is SOC 2?

SOC 2 is an audit report on a vendor's controls. Controls are the rules, tools and routines a company uses to protect its systems and data, such as access reviews or backups.

An independent CPA firm examines the controls and writes the report. The AICPA, the US accounting body that sets the standards, describes SOC reports as a way to help customers assess the risks of outsourcing.

A SOC 2 examination looks at controls relevant to five areas, called trust services categories: security, availability, processing integrity, confidentiality and privacy (AICPA guide). According to the Cloud Security Alliance, security is the only required category; the others are added by choice.

SOC 2 is not a certificate. It is a report with an auditor's opinion. As of October 2026, the AICPA SOC page lists an exposure draft of proposed 2027 trust services criteria, so the criteria may be updated.

Type 1 and Type 2

A Type 1 report checks whether controls were designed well on a single date. A Type 2 report also tests whether they worked over a period, often 3 to 12 months (EY). Type 2 tells you far more. See SOC 2 Type 1 vs Type 2.

How to ask for one

Start with the vendor's trust center. Some vendors, such as Atlassian, let you download reports there after a click-through NDA. If there is no trust center, ask your account contact in writing.

Ask for the latest Type 2 report for the exact product you use, and say which legal entity you contract with. If the vendor has no report yet, ask when the audit period started and what it will cover, and what evidence it can share meanwhile.

What it proves and what it does not

A clean Type 2 report proves one thing: for the systems in scope, during that period, an auditor tested the listed controls and found them working. It does not cover products outside its SOC 2 scope, months after the period ended, or controls you are expected to run yourself. It is also not a contract promise; those live in your DPA and security addendum.

What it looks like in a vendor's terms

A typical clause reads like this:

We keep a SOC 2 Type 2 report for the services, prepared by an independent auditor each year. If you ask in writing, and accept confidentiality terms, we will give you our latest report. We may change our controls as long as overall protection is not materially reduced.
  • Type 2, each year: a promise to keep the audit current, not just to have had one once.
  • Confidentiality terms: you will likely sign or click through an NDA before you see it.
  • May change our controls: the controls in the report can change after it is issued.

Atlassian's Security Measures name SOC 2 and ISO 27001 under "ongoing verification of compliance against relevant standards."

A real change we caught

Venpo flagged that Insightly's new AI connector is not covered by its SOC 2 report. A vendor can hold a SOC 2 report and still ship new features that fall outside it.

Why it matters to you

Your own customers will ask about your vendors. When you answer a security questionnaire, you lean on your vendors' reports. If a report does not cover the product you use, you cannot honestly rely on it.

SOC 2 reports are restricted use: meant for the vendor, its customers and others who understand them, not the public (Journal of Accountancy). The short public version is the SOC 3 report, a general-use report that can be shared freely.

What to check

How Venpo helps

Venpo monitors your vendors' public legal pages, including trust center pages, security addenda, DPAs and subprocessor lists. When a security commitment or subprocessor changes, you get a plain-English email with what changed and why it matters.

Start for free

Frequently asked questions

Is SOC 2 a certification?

No. SOC 2 is an attestation report: a CPA firm gives an opinion on the vendor's controls. People call it a certification, but there is no SOC 2 certificate.

How old can a SOC 2 report be?

There is no official expiry date. If the report period ended many months ago, ask for a newer report or a bridge letter.

Can a vendor refuse to share its SOC 2 report?

It can, since the report is restricted use. Vendors that have one often share it with customers under an NDA, and some offer a SOC 3 summary to anyone.

Does a SOC 2 report mean my data is safe?

Not on its own. It shows specific controls worked for specific systems in a past period, so you still need to check scope, exceptions and your own responsibilities.

Related terms

Comparisons SOC 2 Type 1 vs Type 2 A SOC 2 Type 1 report checks whether a vendor's security controls are well designed on a single date. A Type 2 report also tests whether those controls actually worked over a period of months, which makes it stronger evidence. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Security and Compliance SOC 2 Scope SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand. Comparisons SOC 2 vs ISO 27001 SOC 2 is a US audit report, written by a CPA firm, on how well a vendor's security controls are designed and run. ISO 27001 is an international certification that a vendor runs a managed security program. Both are useful, and SOC 2 gives you more detail to read. Security and Compliance SOC 3 Report A SOC 3 report is a short, public summary of a vendor's SOC 2 audit. It shows the auditor's overall opinion but leaves out the controls tested and the detailed results, so it cannot replace the full SOC 2 report. Security and Compliance Security Questionnaire A security questionnaire is a list of questions a buyer sends a vendor about how it protects systems and data: access, encryption, testing, incidents and subprocessors. The answers describe the vendor on the day they were written.

Sources

Last reviewed