[GTM glossary](/glossary.md) SOC 2 Data & Enrichment # SOC 2 (SOC 2) Also known as: SOC 2 compliance, SOC 2 report In short SOC 2 is an auditing framework and report from the American Institute of Certified Public Accountants (AICPA) that evaluates how a service organization manages customer data. An independent auditor tests the provider's controls against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Buyers of data, sales, and marketing software often ask for a SOC 2 report during vendor security review. It is evidence about controls, not a legal certification or a guarantee that nothing will go wrong. This is general information, not legal advice. ## Type 1 vs. Type 2 * **Type 1:** Tests whether controls are designed appropriately at a single point in time. * **Type 2:** Tests whether controls actually operated effectively over a period, commonly several months. Many security teams give it more weight. --- ## The five trust services criteria A report can cover only some criteria, so check which ones are in scope. * **Security:** Protection against unauthorized access. This one is always included. * **Availability:** The system is available as committed. * **Processing integrity:** Processing is complete, accurate, and timely. * **Confidentiality:** Confidential information is protected. * **Privacy:** Personal information is handled according to stated commitments. --- ## Why GTM teams run into it Say a RevOps lead wants to connect a data enrichment tool to the CRM. The company's security team will probably ask the vendor for its SOC 2 report before approving access to customer records. Sales teams selling to larger companies face the same request in reverse. * **Procurement speed:** Having a current report ready shortens security reviews. * **Vendor evaluation:** It is one input when choosing tools that touch contact or customer data. --- ## How to read a SOC 2 report * **Report date and period:** Check it is recent and, for Type 2, how long the period was. * **Scope:** Confirm the product you plan to use is covered, not just the company. * **Exceptions:** Read the auditor's opinion and any noted exceptions. * **Subservice providers:** See which cloud or other vendors are included or excluded. --- ## Common misconceptions * **"SOC 2 certified":** SOC 2 is an attestation report, not a certificate you pass or fail in the usual sense. * **It covers privacy law:** It does not replace GDPR or CCPA compliance. --- ## SOC 2 FAQs **What is SOC 2?** SOC 2 is an audit report, developed by the AICPA, in which an independent auditor evaluates a service provider's controls for protecting customer data. It is based on the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. **What is the difference between SOC 2 Type 1 and Type 2?** A Type 1 report assesses whether controls are suitably designed at one point in time. A Type 2 report tests whether those controls operated effectively over a period of time, usually several months, so it gives stronger evidence of day-to-day practice. **Is SOC 2 the same as GDPR compliance?** No. SOC 2 is a voluntary audit of a provider's security and related controls. GDPR is a European law governing personal data processing. A SOC 2 report may support privacy efforts but does not prove legal compliance. This is not legal advice. **Why do buyers ask for a SOC 2 report from software vendors?** Security teams use it as independent evidence that a vendor has controls in place for handling customer data. It helps them assess risk before connecting a tool to systems like the CRM, and it often speeds up vendor security reviews. Share term --- ## More related phrases * [Data security](/glossary/data-security.md) * [Security questionnaire](/glossary/security-questionnaire.md) * [CAN-SPAM](/glossary/can-spam.md) ## Similar phrases * [Data privacy](/glossary/data-privacy.md) Data privacy is the set of rules and practices that govern how personal information is collected, used, stored, and shared, so people keep control over their data. * [GDPR compliance](/glossary/gdpr-compliance.md) GDPR compliance means meeting the requirements of the EU General Data Protection Regulation when collecting, using, and storing personal data of people in the European Union. * [CRM integration](/glossary/crm-integration.md) CRM integration connects your customer relationship management system with other tools, such as marketing automation, data providers, and sales engagement, so records and activity sync automatically between them. * [Data quality](/glossary/data-quality.md) Data quality describes how well a dataset is fit for its intended use, measured by traits such as accuracy, completeness, consistency, timeliness, and uniqueness. * [Data warehouse](/glossary/data-warehouse.md) A data warehouse is a central system that stores structured data from many sources, such as CRM and product usage, organized for reporting and analysis.