# How to Check If a Company Is SOC 2 Compliant > How to check a vendor's SOC 2 claim: ask for the report, then check the type, dates, auditor, scope, opinion and exceptions. A checklist for small offices. Source: https://learn.ynteractive.com/content/blog/how-to-check-if-a-company-is-soc-2-compliant · Updated 2026-10-21 · Free from Stepthrough (https://learn.ynteractive.com) Quick answer To check whether a company is [SOC 2](https://learn.ynteractive.com/content/glossary/soc-2-report) compliant, ask for its current SOC 2 report, usually shared under [NDA](https://learn.ynteractive.com/content/glossary/non-disclosure-agreement) through its trust center, then check the report type, the period covered, the CPA firm, the scope, the opinion and any exceptions. A website badge is not proof. The free [Safe AI at Work lesson](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste) covers what comes next. Last updated October 21, 2026 [Take the free module →](https://learn.ynteractive.com/courses/ai-at-work/2)Module 2 of the free [AI at Work: Start Here](https://learn.ynteractive.com/courses/ai-at-work) course, about 7 minutes. No account needed. By [Robert Breen](https://learn.ynteractive.com/content/about) · Published October 21, 2026 · Updated October 21, 2026 · 4 min read Security · AI Policy · Vendors This guide is for office managers, operations leads and owners who are choosing software, including AI tools, and want a quick, honest read on a vendor's security claim without being auditors. ## What does "SOC 2 compliant" actually mean? It means an independent auditor examined the company's controls against the AICPA's Trust Services Criteria and issued a [SOC 2 report](https://learn.ynteractive.com/content/glossary/soc-2-report). The criteria cover five areas: security, availability, processing integrity, confidentiality and privacy. Security is always included; the other four are optional, so a report may cover only some of them. SOC 2 is an attestation report, not a certificate. There is no pass or fail badge from the AICPA, so the report itself is the evidence. ## How do I get a company's SOC 2 report? Ask. Most vendors that have one say so on a security or "trust center" page and share the report after you sign an NDA or request access. If a sales rep says "we're SOC 2 compliant" but won't share the report, treat the claim as unproven. Some companies also publish a SOC 3 report. It covers the same areas with much less detail and is meant for general use, so it is a good first look, but it doesn't show the test results a SOC 2 report does. ## What should I check in a SOC 2 report? Six things, all near the front of the report: 1. **Type.** A Type 1 report looks at whether controls are designed properly on one date. A Type 2 report also tests whether they worked over a period, often 6 to 12 months. Type 2 is the stronger evidence. 2. **Period and date.** Check the dates covered. A report whose period ended more than a year ago is stale. 3. **Auditor.** The report is signed by an independent CPA firm. Note the name; you can look the firm up. 4. **Scope.** Make sure the product or service you will use is covered. A report on a company's payroll product says little about its AI [chatbot](https://learn.ynteractive.com/content/glossary/chatbot). 5. **Opinion.** An unqualified opinion is the clean result. A qualified opinion means the auditor found a significant problem, and the report explains it. 6. **Exceptions.** In a Type 2 report, look at the test results for controls that failed. A few minor exceptions are common; read what they were and how the company responded. ## What is in the report that applies to me? Look for the section on **complementary user entity controls**. These are the things the vendor assumes you do, such as turning on multi-factor authentication, removing users who leave and reviewing access. If you don't do them, the vendor's controls don't fully protect you. Also check **subservice organizations**, such as the cloud host the vendor runs on. Many reports carve these out, meaning the cloud provider's controls are covered by its own report, not this one. ## What if the report period ended a while ago? Ask for a **bridge letter**, sometimes called a gap letter. It is a short letter from the company's management, not the auditor, saying whether anything significant changed between the end of the report period and today. It is a reasonable stopgap for a few months, not a substitute for a new report. ## How does this fit into choosing an AI tool? A SOC 2 report answers "does this company run its security well?" It doesn't answer "will my team paste the wrong thing into it?" For AI tools, check both: - The vendor's report and its data-use terms, including whether business data is used for training. - Your own rules: which tools are approved, what may be pasted in and who checks the output. The free [Team AI Policy lesson](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude) has Claude turn your decisions into a one-page policy. ## Try it free, step by step **Use AI at Work Without Leaking Client Data using ChatGPT**. Turn off model training, strip a tenant's bank details and address out of a prompt, then catch the two promises ChatGPT made up before the reply goes out. You do every step yourself in a practice copy of ChatGPT, it checks your work as you go, and “Do it for me” finishes any step you get stuck on. Free, and nothing touches your real accounts. [Start the free lesson](https://learn.ynteractive.com/modules/safe-ai-at-work) [Or read the full step-by-step guide](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste) ## Key takeaways - "SOC 2 compliant" means an independent CPA firm issued a SOC 2 report on the company's controls. - Ask for the report itself; a website badge or a sales claim is not proof. - Check the type, the period, the auditor, the scope, the opinion and any exceptions. - Read the complementary user entity controls: they list what you must do on your side. - A bridge letter can cover a short gap after the report period ends. ## Frequently asked questions **Is SOC 2 a certification?** No. It is an attestation report by an independent auditor. People say "SOC 2 certified" informally, but there is no certificate, only the report. **What is the difference between SOC 2 Type 1 and Type 2?** Type 1 checks that controls are designed well on a single date. Type 2 also tests that they operated effectively over a period, usually several months, so it is stronger evidence. **Can I look up whether a company has a SOC 2 report?** Not in a public registry. Ask the company for the report or check its trust center. Some publish a SOC 3 report you can read without an NDA. **Does a small business need its own SOC 2 report?** Usually only if your own customers ask for one. Most small offices are on the buying side and need to know how to read a vendor's report, not how to get one. ## Where can I go next? For the data-use side of AI tools, see [Is It Safe to Paste Client Data into ChatGPT?](https://learn.ynteractive.com/content/blog/is-it-safe-to-paste-client-data-into-chatgpt) and the [AI vendor risk assessment](https://learn.ynteractive.com/content/glossary/ai-vendor-risk-assessment) entry. ## Free lessons in this post - [Use AI at Work Without Leaking Client Data using ChatGPT](https://learn.ynteractive.com/content/safe-ai-at-work-what-not-to-paste): Turn off model training, strip a tenant's bank details and address out of a prompt, then catch the two promises ChatGPT made up before the reply goes out. - [Roll Out a Team AI Policy in One Afternoon using Claude](https://learn.ynteractive.com/content/ai-acceptable-use-policy-claude): Your team already uses AI, with or without rules. Have Claude write a one-page acceptable use policy from your rules, check the parts that matter, then get the… ## Watch it in a free lesson: ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes ### ChatGPT: Keep Client Data Safe, Set Up Your Team’s Data Controls in 10 Minutes: video walkthrough Full walkthrough · 3:05 · with captions A client asks if their files go into ChatGPT. Answer with confidence: set the data controls, memory, Temporary Chat and shared links, then hand your team a one-page AI policy. The whole lesson narrated step by step, recorded in Stepthrough’s simulated practice environment. [Watch it with chapters and the full transcript](https://learn.ynteractive.com/content/chatgpt-data-controls-protect-client-data#watch) From the free lesson [ChatGPT: Keep Client Data Safe, Set Up Your Team's Data Controls in 10 Minutes](https://learn.ynteractive.com/content/chatgpt-data-controls-protect-client-data) ## Related terms Plain-English definitions, each with an example from a free lesson. [SOC 2 report](https://learn.ynteractive.com/content/glossary/soc-2-report) · [Non-disclosure agreement (NDA)](https://learn.ynteractive.com/content/glossary/non-disclosure-agreement) · [Chatbot](https://learn.ynteractive.com/content/glossary/chatbot) · [AI policy](https://learn.ynteractive.com/content/glossary/ai-policy) · [Improve the model for everyone](https://learn.ynteractive.com/content/glossary/improve-the-model-for-everyone) · [Model card](https://learn.ynteractive.com/content/glossary/model-card) · [Responsible AI](https://learn.ynteractive.com/content/glossary/responsible-ai) · [Data classification](https://learn.ynteractive.com/content/glossary/data-classification) [The full AI glossary](https://learn.ynteractive.com/content/glossary) ## Related prompts - [ChatGPT settings checklist prompt](https://learn.ynteractive.com/content/prompts/chatgpt-account-settings-checklist-prompt): A copy-ready prompt that turns your plan and data rules into a one-page checklist of ChatGPT settings for staff, with a column… - [AI assistant answer scorecard prompt](https://learn.ynteractive.com/content/prompts/ai-assistant-answer-scorecard-prompt): A prompt that checks four AI assistants' answers to the same task against your own facts and fills a scorecard, so you can pick… - [AI data level sorting prompt](https://learn.ynteractive.com/content/prompts/ai-data-level-sorting-prompt): A copy-ready prompt that sorts your office's common documents into Public, Internal, Confidential and Restricted, with one AI… [All free prompt templates](https://learn.ynteractive.com/content/prompts) ## Keep reading - [How to Write an AI Acceptable Use Policy (Free Template)](https://learn.ynteractive.com/content/blog/ai-acceptable-use-policy-template): A free AI acceptable use policy template you can copy: approved tools, what data staff may paste, who reviews output and what to do after a mistake. - [How to Stop ChatGPT Training on Your Chats](https://learn.ynteractive.com/content/blog/how-to-stop-chatgpt-training-on-your-chats): Turn off "Improve the model for everyone" in ChatGPT's Data controls, and see what the setting does and doesn't protect. Free practice lesson included. - [AI Automation for HR Teams: 12 Questions Answered](https://learn.ynteractive.com/content/blog/ai-automation-for-hr-teams-faq): How HR teams use AI for a handbook agent, leave replies that don't overpromise and a team AI policy, with the guardrails each one needs. [All blog posts](https://learn.ynteractive.com/content/blog) · [All free tutorials](https://learn.ynteractive.com/content)