What SOC 2 means
SOC 2 reports cover controls for security and, optionally, availability, confidentiality, processing integrity and privacy. A Type I report looks at controls at a point in time; Type II tests them over a period. Larger clients often ask SaaS and service vendors for one.
Why it matters for your website
Larger clients often ask vendors for a SOC 2 report before signing, so having one can open doors to bigger contracts. It also gives you a clear way to judge the software vendors you trust with your own data.
Example
A hypothetical HR software startup loses a deal because the buyer requires a SOC 2 report, so it starts preparing for an audit before the next big pitch.
Tips
- Ask your key software vendors for their SOC 2 report before trusting them with data.
- Read the report's scope and exceptions, not just the cover page.
- Start with policies and access controls well before booking an auditor.
Common mistakes
- Treating a SOC 2 report as a certificate that guarantees a vendor is safe.
- Assuming a hosting provider's SOC 2 report covers your own application too.
Questions about SOC 2
What is SOC 2?
An audit framework from the AICPA that reports on how a service company protects customer data.
What is the difference between SOC 2 Type I and Type II?
Type I looks at whether controls are designed properly at one point in time. Type II tests whether those controls actually worked over a period of time, so buyers usually value it more.
Is SOC 2 required by law?
No, it is a voluntary framework. It is often required by customers in contracts, especially in B2B software and services.
