Skip to content

Glossary drawing · Security & identity

SOC 2

Also called: SOC 2 report · SOC 2 Type II · System and Organization Controls 2

Note 1 —An independent CPA's report on how well a service provider's controls meet the AICPA Trust Services Criteria, at a point in time or over a period.

Term
SOC 2
Abbreviation
—
Category
Security & identity
Level
Foundation
Reviewed
Sheet no.
GLO-SEC-652
Drawn by
InfiQ Glossary

Drawing 1 · Interactive

Type I or Type II: what does each report prove?

7 / 7

Type I

Designed right, on one day

Type II

Worked, over months

  1. Type IAre the controls suitably designed and in place?
    Type IIDid the controls operate effectively throughout the period?
  2. Type IA single "as of" date
    Type IIA review period, commonly 3–12 months
  3. Type IInquiry and inspection of design
    Type IISampling evidence across the whole period
  4. Type IDesign gaps only; nothing tested over time
    Type IIListed per control, with management's response
  5. Type IWeeks after readiness
    Type IIThe period plus fieldwork, then yearly
  6. Type IA first report, early deals
    Type IIWhat most enterprise buyers ask for

Verdict

Ask for the most recent Type II, check when its period ended, and request a bridge letter for the months since.

The two SOC 2 report types side by side, row by row: the question each answers, the time it covers, how the auditor tests and which one enterprise buyers usually ask for.

Verdict: Ask for the most recent Type II, check when its period ended, and request a bridge letter for the months since.

What is SOC 2?

SOC 2 (System and Organization Controls 2) is a framework from the American Institute of Certified Public Accountants (AICPA) for reporting on the controls a service organisation uses to protect the systems and data it handles for customers. A licensed CPA firm examines those controls against the Trust Services Criteria — security, availability, processing integrity, confidentiality and privacy — and issues an attestation report containing its opinion.

There are two types. A Type I report says whether controls were suitably designed and in place on one date. A Type II report goes further: the auditor samples evidence across a review period, commonly between three and twelve months, tests whether the controls actually operated effectively throughout and lists any exceptions. Buyers usually want a Type II, and a recent one — reports are generally treated as current for about a year after the period ends, with a bridge letter from the provider covering the months since.

A SOC 2 report is confidential, shared under NDA, and long: a description of the system, the auditor's opinion, every control with the test performed and its result, and the complementary user entity controls that customers must run themselves. That makes it different from ISO/IEC 27001, a certification against a published standard with a certificate anyone can see. For a WhatsApp Business API provider, the report should state which services are in scope and how subservice organisations such as Meta's Cloud API and the cloud host are treated — usually carved out, meaning their controls are not tested in this report.

Key takeaways

  • SOC 2 is an attestation report in which an independent CPA firm examines a service provider's controls against the AICPA Trust Services Criteria.
  • A Type I report tests control design on a single date; a Type II tests operating effectiveness over a period, typically 3 to 12 months.
  • Security is always in scope; availability, processing integrity, confidentiality and privacy are added when relevant.
  • SOC 2 is a report to read, not a certificate: check the scope, the period, the exceptions and the controls left to you.
  • US buyers usually ask for SOC 2 Type II; ISO/IEC 27001 certification is more common in India, Europe and Asia.

Specifications

SOC 2: key facts and limits

Issued by
A licensed CPA firm, under AICPA attestation standards
Criteria
Trust Services Criteria: security + up to 4 more
Type I
Control design on a single date
Type II
Operating effectiveness over a period (commonly 3–12 months)
Distribution
Restricted use, under NDA (SOC 3 is the public summary)
Treated as current
About 12 months after the period ends
vs ISO/IEC 27001
Attestation report vs certification

Operating sequence

How does SOC 2 work?

  1. Define the scope

    Choose the system (services, infrastructure, people, data), which Trust Services Criteria to include beyond security, and whether subservice organisations are carved out or included.

  2. Close the gaps

    A readiness assessment maps existing controls to the criteria — the common criteria alone run from CC1 to CC9 — and fixes what is missing: written policies, access reviews, logging, vendor risk and incident response.

  3. Get a Type I (optional)

    Many first-time providers obtain a Type I to show design on a date, then start the Type II observation period.

  4. Operate and collect evidence

    Throughout the period every control must run and leave evidence: change tickets, approvals, access-review sign-offs, alerts and training records.

  5. Fieldwork and report

    The CPA firm samples the evidence, tests each control and issues the report with its opinion and any exceptions. The cycle then repeats every year.

Design intent

Why does SOC 2 matter?

When a bank, insurer or SaaS company evaluates a messaging provider, its security team needs evidence that customer phone numbers, conversation data and access tokens are handled properly — and a vendor's own claims are not evidence. A SOC 2 Type II gives that evidence from an independent auditor, shortens security questionnaires and is often a contract requirement for US customers. For the provider, the controls it forces — access reviews, change management, incident response, vendor management — are good hygiene in their own right.

Example: Vendor review at a Pune SaaS company

A Pune SaaS company selling to US clinics needs a WhatsApp provider for appointment reminders. Its security team asks shortlisted providers for their latest SOC 2 Type II. One shares a Type I from last year. Another shares a Type II covering 1 January to 30 June 2026 with a bridge letter to September, two minor exceptions with remediation notes, and Meta and its cloud host carved out as subservice organisations. The team maps that report's complementary user entity controls — protecting API tokens, reviewing its own dashboard users — to named owners and signs with the second provider.

Failure modes

Common mistakes with SOC 2

  • Accepting a logo instead of the report

    A badge on a website says nothing about scope or exceptions. Ask for the full report under NDA and read the opinion, the period and the exceptions section.

  • Missing what is out of scope

    A report may cover one product or one region and carve out subservice organisations. Check that the service you are buying — and where your data lives — is actually in scope.

  • Ignoring complementary user entity controls

    The report assumes customers do certain things, such as reviewing their own users and protecting their API tokens. If you do not, the provider's controls do not protect you.

  • Treating an old report as current

    A Type II whose period ended 18 months ago describes a different company. Ask for the latest report and a bridge letter covering the gap since.

Recommended practice

Best practices for SOC 2

  • Read the control-by-control test results before the summary pages.
  • Give every complementary user entity control an owner in your own team.
  • For Indian deals, also ask about ISO/IEC 27001 certification and CERT-In incident-reporting readiness.
  • Diary each vendor's report period end and request the next report automatically.

SOC 2 FAQs

What is the difference between SOC 2 Type I and Type II?+
Type I checks control design on one date; Type II tests that controls worked over a period. Type II is stronger evidence because the auditor samples real activity across months and reports any exceptions it finds.
Is SOC 2 a certification?+
No. SOC 2 is an attestation report containing a CPA firm's opinion, not a pass-or-fail certificate. People say "SOC 2 certified" loosely, but what exists is a report you should read in full.
SOC 2 or ISO 27001: which matters more in India?+
It depends on the buyer. Indian and European enterprises often ask for ISO/IEC 27001 certification, while US customers usually expect a SOC 2 Type II; providers selling to both commonly maintain both.
How long is a SOC 2 report valid?+
There is no formal expiry, but buyers generally treat a report as current for about 12 months after its period ends. Beyond that, ask for the next report or a bridge letter from the provider.
Does my WhatsApp provider's SOC 2 cover Meta's Cloud API?+
Usually not. Providers typically carve out Meta and their cloud host as subservice organisations, so the report tests the provider's own controls and points to those organisations for the rest.

See InfiQ pricing

Put SOC 2 to work

InfiQ is an official Meta Business Partner. Start a 7-day free trial — no card needed — and see this running on your own number.

Start free trialBrowse all 550 terms