Start for free Start for free

SOC 2 Scope

SOC 2 scope is the boundary of what a SOC 2 report covers: which products, systems, locations, legal entities, trust services categories and time period. Anything outside it was not examined, even if it carries the same brand.

What is SOC 2 scope?

SOC 2 scope is the boundary of a SOC 2 report. It says exactly what the auditor examined. Anything outside it was not examined, even if it has the vendor's name on it.

The scope is set by the vendor's management and written into the system description (AICPA). It has several parts:

  • Services: which products or modules are covered.
  • System: the infrastructure, software, people, processes and data behind them.
  • Entity: which legal company and which locations or regions.
  • Categories: security is always in; availability, processing integrity, confidentiality and privacy only if chosen (Cloud Security Alliance).
  • Period: the dates the controls were tested.
  • Outside providers: which subservice organizations were included and which were carved out.

What often falls outside

New products launched after the audit period. Companies the vendor bought recently. Beta features, integrations and connectors. Regions or data centers added later. And the controls the report expects you to run, called complementary user entity controls.

How scope connects to your contract

Your contract and the report can describe different things. The order form lists what you bought. The report lists what was audited. The two lists do not always match, and nobody checks that for you.

The time period is part of scope too. A Type 2 report tests controls over a set window. Anything that changed after the window closed, such as a new data center or a new AI feature, waits for the next report.

What it looks like in a vendor's terms

A typical clause reads like this:

Our security commitments and audit reports apply to the services listed in your order form. Beta features, free tools and third-party integrations are excluded and provided as is.
  • Services listed in your order form: only those products count.
  • Beta features excluded: previews and early releases sit outside the promises. See beta terms.
  • Third-party integrations: connectors to other services may not be covered.

Atlassian's SOC 2 page shows how scope splits by product: its download links name the products each report covers, and the report for one product, Atlassian Focus, is labeled Type 1.

A real change we caught

Venpo flagged that Insightly's new AI connector is not covered by its SOC 2 report. Insightly's updated terms say its new MCP Server, which lets an outside AI assistant read and update your CRM, is "not within the scope of the current report." Data that flows through it was not part of what the auditor examined.

This pattern matters as vendors add AI features fast. An AI connector can move your data to new places long before the next audit catches up.

Why it matters to you

You rely on scope every time you tell a customer, auditor or insurer that a vendor is "SOC 2 compliant." If the feature your team uses is out of scope, that statement is not accurate.

Out-of-scope features can also change your data flows. A new connector may send data to an AI subprocessor that no report covers.

Here is how a gap usually opens:

  1. You review the vendor's SOC 2 report and approve the vendor.
  2. The vendor ships a new feature, connector or region after the audit period.
  3. Your team turns it on, and data starts to flow through it.
  4. Your records still say the vendor is covered, but that part was never examined.

What to check

  • Find the list of services in scope and match it against what you actually use.
  • Check that the legal entity in the report is the one on your contract.
  • Check which trust services categories are included. If uptime matters, look for availability.
  • Ask whether new features, AI tools and integrations you use are covered, and when they will be.
  • Compare carved-out providers with the subprocessor list.
  • Check the period dates, and ask for a bridge letter if the period ended months ago.

When you find a gap, write it down with a date and an owner. Then ask the vendor in writing whether the missing product is in the next audit, and set a reminder to check when the new report comes out. If the gap involves sensitive data, decide whether to keep that feature turned off until it is covered.

How Venpo helps

Venpo monitors your vendors' public legal pages, including trust center pages, subprocessor lists, AI terms and beta terms. When a new feature, connector or subprocessor shows up, you get a plain-English email so you can ask whether it is in scope.

Start for free

Frequently asked questions

Does a vendor's SOC 2 report cover all its products?

Not necessarily. Each report lists the services it covers, and large vendors often have different reports, or none, for different products.

Who decides what is in SOC 2 scope?

The vendor's management sets the scope and the auditor examines what is inside it. You can ask the vendor to expand scope, but you cannot force it.

Is a new feature covered by last year's SOC 2 report?

Only if it was part of the system during the audit period. Features launched later wait for the next report, so ask the vendor directly.

Related terms

Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. AI and Your Data AI Connector (MCP Integration) An AI connector, such as one built on the Model Context Protocol (MCP), is a link that lets an AI assistant read data from or take actions in one of your business apps, using a user's permissions. Security and Compliance Carve-Out Method (Subservice Organizations) The carve-out method is how a SOC report leaves out the controls of a vendor's own providers, such as its cloud host. The report names those providers, but the auditor does not test their controls, so you need other evidence for them. Vendor Documents Beta Terms Beta terms are the rules for a vendor's unreleased features, such as beta, preview or early access. They often remove warranties, cut liability to a small amount and let the vendor change or end the feature at any time. Vendor Documents Subprocessor List A subprocessor list is a public page where a vendor names the other companies that handle your data for it, with what each one does, where it is, and what data it touches. It changes whenever the vendor adds or drops a provider.

Sources

Last reviewed