# What is SOC 2?

Also called SOC 2 Type 2, Service Organization Control 2.

SOC 2 is an attestation report produced by an independent accounting firm assessing a service organization's controls against the Trust Services Criteria defined by the American Institute of Certified Public Accountants. Security is always in scope, with availability, processing integrity, confidentiality, and privacy optional. It is a report on controls, not a certification or a legal requirement.

There are two report types, and the difference is substantial. A Type 1 report assesses whether controls are suitably designed at a single point in time. A Type 2 report assesses whether those controls operated effectively across a period, commonly three to twelve months, with the auditor sampling evidence throughout. Buyers evaluating a vendor typically ask for Type 2, since design without operation proves little.

The framework is deliberately not prescriptive. It does not mandate specific technologies or settings. The organization defines its own controls against the criteria, and the auditor tests whether those controls exist and function as described. Two vendors can hold clean reports with quite different security postures, which is why reading the scope, the period, the systems covered, and any noted exceptions matters more than the fact a report exists.

SOC 2 is voluntary, driven by customer expectation rather than statute, and is most established in North American software procurement. In other markets ISO/IEC 27001 certification is often the more familiar signal, and many vendors maintain both. Reports are usually shared under a nondisclosure agreement, since they describe control environments in detail.

For AI features the practical question is whether they are inside the audited scope. A report covering a core platform does not automatically cover a newly added assistant, its model provider, its vector store, or its trace storage. Scope sections and subprocessor lists are the place to check, and a vendor adding AI capabilities may not have brought them into scope yet.

## Key points

- An attestation report from a CPA firm, not a certification
- Type 1 tests design at a point in time, Type 2 tests operation over a period
- Security is always in scope, four other criteria are optional
- The organization defines its own controls, so scope matters most
- Newly added AI components may sit outside the audited scope

## In practice

A buyer receives a vendor's Type 2 report and reads past the cover. The observation period ended eight months earlier, the scope names the core application but not the assistant feature launched since, and two exceptions are noted around access review timeliness. None of that makes the vendor unsuitable, but it changes the questions asked next, which is exactly what reading the report is for.

## Related terms

- [AI Governance](/en/glossary/ai-governance)
- [Audit Trail](/en/glossary/audit-trail)
- [Tenant Isolation](/en/glossary/tenant-isolation)
- [Data Processing Agreement](/en/glossary/data-processing-agreement)
- [Least Privilege](/en/glossary/least-privilege)

[Back to the AI Glossary](/en/glossary)