What is SOC 2?

What it covers

System and Organization Controls (SOC) is a suite of reporting services from the AICPA, the American Institute of CPAs. A SOC 2 report covers controls at a service organization that are relevant to one or more of five trust services categories: security, availability, processing integrity, confidentiality and privacy. Security is the baseline, and the other four are added when they matter to the service.

The AICPA describes SOC engagements as services that CPAs provide, using professional standards the AICPA sets. The report is therefore the work of an independent auditor, not a statement by the vendor about itself. It contains the auditor’s opinion, management’s description of the system, the controls in scope and the results of testing, including any exceptions.

There are two kinds. A Type I report looks at whether controls were suitably designed at a single point in time. A Type II report also tests whether the controls operated effectively over a stated period, which is why buyers usually ask for Type II.

What it requires

Nothing in law requires a SOC 2 report. Companies obtain one voluntarily, usually because customers ask for it in security reviews, and the framework does not give a pass or fail grade. The report describes what was examined and what the auditor found. “SOC 2 certified” is a common phrase but a loose one, because no certificate is issued.

What it means for a voice agent

A voice agent sends callers’ speech, names, account details and sometimes health or payment information through several systems. A SOC 2 report is one of the fastest ways to see how a vendor runs access control, change management, logging and incident response. When you read one, check these points:

• Which system and which services are in scope. A report on a company’s web dashboard may not cover its real-time audio path.
• The period tested, and whether it is recent. A gap between the end of the period and today may call for a bridge letter.
• Which trust services categories are included. Security alone says little about confidentiality or privacy.
• Exceptions and the auditor’s opinion, not only the cover page.
• Whether the vendor’s own sub-vendors, such as a cloud host, are carved out of the report.
• Who signed the report. A report is only as credible as the firm that signed it.

A SOC 2 report is evidence, not a substitute for other obligations. It does not replace a business associate agreement under HIPAA, a data processing agreement under GDPR, or a PCI assessment where card data is involved (PCI DSS). It also does not say how long audio is kept, which is a configuration choice described under zero data retention. For a buying checklist, read the guide on on-premise voice AI.

Questions to ask counsel

1. Is a SOC 2 report enough for our customer contracts, or do they call for something else?
2. Which categories and which services must be in scope for the use case we have?
3. What do we do about the period between a report’s end date and our go-live date?
4. How should we treat exceptions the auditor noted?
5. Can we share the vendor’s report with our own customers, and under what terms?

Related terms

• HIPAA
• GDPR
• PCI DSS
• Zero data retention

Guides

• On-premise voice AI: what it is and how it works

Sources

• AICPA and CIMA, System and Organization Controls (SOC) suite of services