Best AI for AdvisorsWhat is SOC 2?
Also called: SOC 2 report, SOC 2 Type II.
Short answer
An independent CPA's report on a service provider's controls for security and related areas, used in vendor due diligence.
Definition
A SOC 2 report is an examination by an independent CPA firm of a service organization's controls relevant to one or more of five areas: security, availability, processing integrity, confidentiality and privacy. The AICPA sets the framework.
A Type I report looks at control design at a point in time. A Type II report also tests whether the controls operated over a period, usually several months to a year.
Why it matters for advisors
It's the most common evidence AI vendors offer that they handle data responsibly, and a reasonable part of vendor due diligence. Ask for the report itself, not just a badge on the website.
As our vendor due diligence guide puts it, a SOC 2 report isn't a certification, a guarantee or an endorsement, and it says nothing about anything outside its scope. Check the scope, the period, any exceptions and whether the AI features you'll use are covered.
Example
A vendor shares its SOC 2 Type II report. The CCO notices the AI summarization service launched after the report period and asks how it's covered.
Watch out for
A SOC 2 report doesn't answer AI-specific questions such as training on your data or which sub-processors see it. Ask those separately.
Related terms
- Vendor due diligenceReviewing an AI vendor's security, data use, contracts and controls before your firm buys, and checking again over time.
- Sub-processorA third party your vendor uses to handle your data, such as the AI model provider behind a notetaker or CRM assistant.
- Encryption in transit and at restScrambling data so only authorized systems can read it, both while it moves over a network and while it's stored.
- Data processing agreementThe contract terms that set how a vendor may use, protect, share, keep and delete the data you give it.
Learn more
Sources
Last updated .