What is SOC 2?

What is SOC 2?

SOC 2 (System and Organization Controls 2) is an auditing framework developed by the AICPA that evaluates how service organizations protect customer data. It is one of the most requested security certifications for SaaS companies and technology vendors.

What are the SOC 2 Trust Services Criteria?

SOC 2 is built around five Trust Services Criteria (TSC):

• Security (required) — protection against unauthorized access
• Availability — system uptime and operational reliability
• Processing integrity — accurate and complete data processing
• Confidentiality — protection of confidential information
• Privacy — handling of personal information per commitments

Most organizations start with Security and add additional criteria based on customer requirements.

What is the difference between SOC 2 Type I and Type II?

• SOC 2 Type I evaluates whether controls are designed appropriately at a specific point in time
• SOC 2 Type II evaluates whether controls operated effectively over a period (typically 3-12 months)

Type II reports carry more weight with enterprise buyers because they demonstrate sustained compliance rather than a single snapshot.

Who needs SOC 2?

SOC 2 is not legally required, but it is effectively mandatory for SaaS companies selling to enterprises. Buyers, procurement teams, and security reviewers routinely request SOC 2 reports as part of vendor diligence.

How long does a SOC 2 audit take?

A typical timeline:

• Readiness assessment: 2-4 weeks
• Remediation: 4-12 weeks depending on gaps
• Type I audit: 2-4 weeks
• Observation period for Type II: 3-12 months
• Type II audit: 4-6 weeks

How does episki help with SOC 2?

episki maps the Trust Services Criteria to controls evaluated continuously across AWS, GitHub, Google, Microsoft, Slack, Supabase, Vercel, and Netlify — each writing pass, fail, or inconclusive rather than filing a screenshot. Auditor guest access is scoped per assessment and not billed per seat, and evidence carries provenance showing exactly how it was gathered. Learn more on our SOC 2 compliance page.