SOC 2 Compliance

SOC 2 is an attestation framework used by customers to assess how a service organization manages controls relevant to security, availability, processing integrity, confidentiality, or privacy. An independent licensed CPA examines the organization under AICPA attestation standards. The resulting report is evidence about a defined system, scope, and period or point in time; it is not a blanket certification that every product is secure.

Type 1 reporting addresses the description of the system and design of controls as of a specified date. Type 2 reporting also evaluates their operating effectiveness over a period. Buyers should check report scope, exceptions, complementary user-entity controls, and whether the services they use are included.

For a website agency, SOC 2 may matter when choosing a CRM, cloud host, payments provider, or analytics vendor handling customer information. A provider's SOC 2 report does not transfer all compliance duties to its customer, and a small business does not automatically require its own report.

As of October 2026, AICPA has proposed updates to the Trust Services Criteria; a published proposal should not be described as already effective requirements.