SOC 2

SOC 2 is an AICPA attestation framework for service organizations. Independent auditors report on controls related to Trust Services Criteria (security, availability, processing integrity, confidentiality, and/or privacy) over a defined period or point in time.

• Applies to service organizations that store or process customer data
• Reports are Type I (point in time) or Type II (period of time)
• Criteria are selected from the AICPA Trust Services Criteria

Enterprise AI buyers often request SOC 2 Type II reports when evaluating SaaS model APIs, agent platforms, and data pipelines that handle customer content. A SOC 2 report describes control design and operating effectiveness — it is not a product “certification badge” issued by AICPA to the vendor’s marketing site alone.

• Reports are typically shared under NDA; public “SOC 2 certified” claims should be verified via the vendor’s trust center or auditor report
• Scope (systems, locations, criteria) varies by engagement

SOC 2 is tracked so buyers and builders can understand official scope, issuing bodies, and AI-relevant obligations — without confusing marketing claims with verified attestation or legal status.

• AICPA — SOC 2
• AICPA — SOC suite of services