SOC 2 (Service Organization Control 2) is an audit standard developed by the American Institute of CPAs that assesses how a service organization manages customer data. Unlike SOC 1 (which focuses on financial reporting controls), SOC 2 assesses technical and operational controls across five "trust service criteria": security, availability, processing integrity, confidentiality, and privacy.
SOC 2 comes in two flavors: Type 1 audits a point-in-time assessment; Type 2 audits control effectiveness over a period (typically six to twelve months). Type 2 is the higher bar and is usually what enterprise buyers require from SaaS vendors before signing contracts.
For AI vendors, SOC 2 Type 2 has become the de facto enterprise trust floor. Any SaaS product without a current SOC 2 report faces substantially more friction in enterprise sales. AI-specific SOC 2 additions — particularly around model training isolation, inference logging, and data retention — are still maturing as audit practices catch up with the nuances of AI workloads.