A SOC 2 report is written by an independent auditor after checking how a service company protects the systems and information it handles for customers. Every report covers security. A company can also choose to include availability, processing integrity, confidentiality and privacy. The auditor judges the company against criteria set by the AICPA. For example, an online tool that stores your donor list might hire an auditor to check who can get into that data and how changes are tracked.
There are two kinds. A Type I report checks whether the controls were designed well at a single point in time. A Type II report checks that they actually worked over a period, usually several months, so it tells you more.
Why it matters
When you choose an AI tool that will handle your organization’s data, a SOC 2 report shows that someone outside the vendor has checked its security. A badge on a website tells you little on its own, so ask for the report itself. Vendors usually share it only after you sign a non-disclosure agreement. Ask whether it is Type I or Type II and which areas it covers. You can also compare it with ISO 27001, pair it with a data processing agreement, and find more questions in this site’s vendor assessment guide.
Published Updated