SOC 2

SOC 2 (Service Organization Control 2) is an attestation performed by a licensed CPA firm against the AICPA's five Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy.

Type 1 reports the design of controls at a point in time. Type 2 reports on the operating effectiveness of those controls over a window — usually 3 to 12 months. Enterprise buyers commonly require Type 2 before signing.

SOC 2 is US-centric and does not certify — it produces a report you share under NDA with prospects and customers.