How to Check If a Company Is SOC 2 Compliant

This guide is for office managers, operations leads and owners who are choosing software, including AI tools, and want a quick, honest read on a vendor's security claim without being auditors.

What does "SOC 2 compliant" actually mean?

It means an independent auditor examined the company's controls against the AICPA's Trust Services Criteria and issued a SOC 2 report. The criteria cover five areas: security, availability, processing integrity, confidentiality and privacy. Security is always included; the other four are optional, so a report may cover only some of them.

SOC 2 is an attestation report, not a certificate. There is no pass or fail badge from the AICPA, so the report itself is the evidence.

How do I get a company's SOC 2 report?

Ask. Most vendors that have one say so on a security or "trust center" page and share the report after you sign an NDA or request access. If a sales rep says "we're SOC 2 compliant" but won't share the report, treat the claim as unproven.

Some companies also publish a SOC 3 report. It covers the same areas with much less detail and is meant for general use, so it is a good first look, but it doesn't show the test results a SOC 2 report does.

What should I check in a SOC 2 report?

Six things, all near the front of the report:

1. Type. A Type 1 report looks at whether controls are designed properly on one date. A Type 2 report also tests whether they worked over a period, often 6 to 12 months. Type 2 is the stronger evidence.
2. Period and date. Check the dates covered. A report whose period ended more than a year ago is stale.
3. Auditor. The report is signed by an independent CPA firm. Note the name; you can look the firm up.
4. Scope. Make sure the product or service you will use is covered. A report on a company's payroll product says little about its AI chatbot.
5. Opinion. An unqualified opinion is the clean result. A qualified opinion means the auditor found a significant problem, and the report explains it.
6. Exceptions. In a Type 2 report, look at the test results for controls that failed. A few minor exceptions are common; read what they were and how the company responded.

What is in the report that applies to me?

Look for the section on complementary user entity controls. These are the things the vendor assumes you do, such as turning on multi-factor authentication, removing users who leave and reviewing access. If you don't do them, the vendor's controls don't fully protect you.

Also check subservice organizations, such as the cloud host the vendor runs on. Many reports carve these out, meaning the cloud provider's controls are covered by its own report, not this one.

What if the report period ended a while ago?

Ask for a bridge letter, sometimes called a gap letter. It is a short letter from the company's management, not the auditor, saying whether anything significant changed between the end of the report period and today. It is a reasonable stopgap for a few months, not a substitute for a new report.

How does this fit into choosing an AI tool?

A SOC 2 report answers "does this company run its security well?" It doesn't answer "will my team paste the wrong thing into it?" For AI tools, check both:

• The vendor's report and its data-use terms, including whether business data is used for training.
• Your own rules: which tools are approved, what may be pasted in and who checks the output. The free Team AI Policy lesson has Claude turn your decisions into a one-page policy.

Key takeaways

• "SOC 2 compliant" means an independent CPA firm issued a SOC 2 report on the company's controls.
• Ask for the report itself; a website badge or a sales claim is not proof.
• Check the type, the period, the auditor, the scope, the opinion and any exceptions.
• Read the complementary user entity controls: they list what you must do on your side.
• A bridge letter can cover a short gap after the report period ends.

Frequently asked questions

Is SOC 2 a certification?

No. It is an attestation report by an independent auditor. People say "SOC 2 certified" informally, but there is no certificate, only the report.

What is the difference between SOC 2 Type 1 and Type 2?

Type 1 checks that controls are designed well on a single date. Type 2 also tests that they operated effectively over a period, usually several months, so it is stronger evidence.

Can I look up whether a company has a SOC 2 report?

Not in a public registry. Ask the company for the report or check its trust center. Some publish a SOC 3 report you can read without an NDA.

Does a small business need its own SOC 2 report?

Usually only if your own customers ask for one. Most small offices are on the buying side and need to know how to read a vendor's report, not how to get one.

Where can I go next?

For the data-use side of AI tools, see Is It Safe to Paste Client Data into ChatGPT? and the AI vendor risk assessment entry.