SOC 2 is an auditing framework defined by the AICPA for service organizations. It reports on controls relevant to the Trust Services Criteria, and a SOC 2 report is produced by an independent CPA firm.
SOC 2 (System and Organization Controls 2) is an attestation framework defined by the AICPA for service organizations that store, process, or transmit customer data. Rather than a pass/fail certification, a SOC 2 engagement produces a report in which an independent CPA firm describes your controls and tests whether they meet the Trust Services Criteria. It has become the de facto baseline that B2B SaaS buyers ask for during procurement and security reviews.
A Type I report attests control design at a point in time and is often pursued first. A Type II report covers operating effectiveness over an observation window that is commonly three to twelve months, so most teams plan around the length of that window rather than a fixed deadline.
Public information about the framework itself. We don't claim certifications, assessment status, or authorizations for our own product.
How the platform supports your SOC 2 program — from first scope to ongoing monitoring.
Decide which Trust Services Criteria apply beyond the required Security category, and define the systems in scope.
Connect the Common Criteria to automated tests and the evidence that proves each control is operating.
Pull configuration and activity evidence on a schedule so your Type II window stays clean instead of scrambling at the end.
Organize evidence the way CPA firms expect to receive it, with owners and history attached to every control.
Public, high-level control or requirement areas — for orientation, not a complete control list.
SOC 2 shares controls with frameworks you may already run. A passing test can satisfy requirements in more than one place — so adding the next framework means reusing work, not repeating it.
No. SOC 2 is an attestation: an independent CPA firm issues a report describing and testing your controls. There is no certificate or governing body that 'certifies' you.
Type I evaluates control design at a single point in time; Type II evaluates operating effectiveness over a period. Many teams start with Type I to validate design, then move to Type II.
Yes. Much of the Security (Common Criteria) evidence overlaps with ISO 27001, HIPAA, and others, which is exactly what cross-mapping is designed to capture.
Get a guided demo, or start by scanning any domain for free.