Data protection and compliance
SOC 2
A US-originated audit report in which an independent auditor tests a service company's controls for security, and optionally availability, processing integrity, confidentiality and privacy. Type I checks the controls are designed properly at one point in time; Type II checks they actually worked over a period, often six to twelve months. SOC 1 is a different report, about controls over financial reporting.
A plain-English explanation of how this usually works, not legal advice. Rules differ between countries and change over time, so check your own situation. Disclaimer.
You'll hear it as
US customers keep asking for our SOC 2 Type II.
Why it matters to you.
It's the American counterpart to ISO 27001 for software companies. A Type II needs months of evidence, so start collecting before you need it.
Related terms.
Videos.
No video mentions SOC 2 by name yet. These are on the same topic, Business & startups.