SOC 2 (System and Organization Controls) is a voluntary compliance standard developed by the American Institute of CPAs (AICPA) for service organizations handling customer data. It covers five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.
SOC 2 Type I attests that controls are designed appropriately at a point in time. SOC 2 Type II is more rigorous — it attests that controls operated effectively over a period (typically 6-12 months) and is required by most enterprise procurement teams.
The audit is performed by an independent CPA firm, results in a SOC 2 report (usually 50-150 pages), and is delivered under NDA. The report typically includes: management's description of the system, the auditor's opinion, the controls tested, and the test procedures and results.