SOC 2: definition and examples

SOC 2

SOC 2 is an independent CPA examination of how a service company protects customer data, reported against the AICPA's Trust Services Criteria. A Type 1 report covers control design at one date; a Type 2 covers how controls worked over a period.

Also called

SOC 2 report, SOC 2 Type 1, SOC 2 Type 2, SOC 2 Type II, System and Organization Controls 2

Category

Security and compliance

Updated

October 2026

SOC stands for System and Organization Controls, a family of reports defined by the AICPA. SOC 2 is the one for service organisations such as SaaS companies. An independent CPA firm examines the company’s description of its system and its controls, then gives an opinion on them against the Trust Services Criteria. Those criteria cover five categories: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the others are included when they matter to the service.

SOC 2 is an attestation report, not a certificate. The output is a report with the auditor’s opinion, a description of the system, the controls and, in a Type 2, the tests performed and any exceptions found.

Why it matters for a SaaS website

For B2B SaaS selling to mid-market and enterprise companies, SOC 2 is one of the first things security and procurement teams ask about. If the website does not say whether you have a report, which type and how to get it, the question lands in a sales call or a long questionnaire, and the deal slows down. Stating the status clearly, including an audit that is still in progress, saves a round of email and reads as a company with nothing to hide.

How DesignMe handles it

We design and build the pages that present a company’s security status, such as security pages and a trust center. Our guidance for B2B SaaS sites is to say which reports you hold, their type and date, and how to request them, and to say so plainly if an audit is still underway. We work from what the client’s security or compliance team confirms. We do not audit, assess or certify anything, and we do not decide what a company can claim: the compliance team owns that.

Example

Say a Series A HR platform has a SOC 2 Type 1 report and is four months into its Type 2 period. Its security page states both facts with dates, explains which Trust Services Criteria are in scope, and has a “Request the report” button that collects the buyer’s company and routes the request to the security team for an NDA.

Common mistakes

Calling it a certification. SOC 2 is an examination report. Say “SOC 2 Type 2 report”, not “SOC 2 certified”.
A badge with no detail. Buyers want the type, the period and how to get the report.
Out-of-date claims. Reports cover a specific date or period. Update the page when a new one is issued.
Hiding an audit in progress. Saying so plainly builds more trust than silence.

Questions

What is the difference between SOC 2 Type 1 and Type 2?

A Type 1 report looks at whether controls are suitably designed as of a single date. A Type 2 report also tests whether they operated effectively over a period of time. Enterprise buyers usually ask for Type 2, and many companies start with Type 1 while the Type 2 period runs.

Can I publish my SOC 2 report on my website?

Usually not in full. SOC 2 reports are meant for customers and prospects who need the detail, so companies normally share them on request, often under an NDA. A SOC 3 report covers the same criteria in a shorter, general-use format that can be posted publicly.