SOC 2 is not a certification stamp. It is an auditor-written report describing exactly which controls the service org has, how they were tested, and whether the auditor saw them operating.
SOC 2 is a security attestation report issued by an independent auditor that evaluates whether a service organization meets controls across the five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Enterprise buyers require SOC 2 reports from SaaS vendors before signing. The report comes in two flavors: Type I (controls designed well at a point in time) and Type II (controls operating effectively over 6 to 12 months).
Six things to understand about SOC 2: what the report actually is, who issues it, which criteria it tests, Type I versus Type II, how long an audit takes, and how it compares to ISO 27001.
A SOC 2 report is a written attestation by a licensed CPA firm, usually 40 to 100 pages. It describes the system in scope, the controls the service org has in place, the tests the auditor ran, and whether the controls operated as described. Buyers read the report, not a certificate.
Only AICPA-registered CPA firms can issue SOC 2 reports. The firm must be independent of the service org being audited. Common SOC 2 auditors include big-four firms, mid-market CPA practices, and specialist attestation firms. The auditor name appears on the first page of the report.
Five Trust Services Criteria: security (required), availability, processing integrity, confidentiality, and privacy. Every SOC 2 includes security. The service org picks which additional criteria to include based on what matters to buyers. SaaS vendors handling PII almost always add confidentiality and privacy.
Type I confirms the controls were designed appropriately at a single moment. Type II confirms the controls operated effectively over a 6 to 12 month observation window. Enterprise buyers want Type II. Type I is a stepping stone, not an endpoint.
A first SOC 2 Type I takes about three months to prepare and audit. Type II requires an additional 6 to 12 months of observation. Teams often release a Type I first (to clear deals that would otherwise block) and move to Type II as the next renewal cycle.
SOC 2 is a US-oriented attestation framework. ISO 27001 is an international management-system certification. US enterprise buyers typically request SOC 2. European and global buyers often request ISO 27001 alongside or instead. Many vendors eventually hold both. The underlying controls overlap substantially.
The Trust Services Criteria define what SOC 2 cares about. Security is always included. The other four are added based on what the service org and its buyers need to prove. A report scoped to security only is weaker than one scoped to security, confidentiality, availability, and privacy.
Who can log in, what they can do, how changes to production are approved, how incidents are detected and resolved. Covers access reviews, MFA, logging, monitoring, vulnerability scanning, and the response playbook. Security is required in every SOC 2 report.
How the service meets its stated SLA. Covers monitoring, redundancy, backup frequency, restore testing, and the disaster recovery plan. Required by buyers with uptime-dependent workflows. Not required by every SaaS, but common when the product is in the critical path.
The system processes what it is supposed to process, without silently dropping, duplicating, or corrupting data. Important for financial systems, billing engines, and any product where data integrity is the value. Less common than security or confidentiality.
Controls that protect data classified as confidential by the service org or its customers (trade secrets, proprietary data, contracts). Encryption in transit and at rest, access reviews, data classification policies, and secure disposal. Common for B2B SaaS handling customer business data.
How personal information is collected, retained, disclosed, and disposed of. Overlaps with GDPR and CCPA but is scoped more narrowly to the service org controls, not legal rights. Required when the product handles PII from end users rather than business data.
The service org decides which criteria to include. Security is mandatory. Confidentiality and privacy are the common add-ons for SaaS handling customer data. Availability is added when uptime matters. Processing integrity is added when transaction correctness is the product. Over-scoping adds audit cost without buyer value.
The two SOC 2 types differ in how much time the auditor observed. Type I is a snapshot. Type II is a time-lapse. Enterprise buyers want time-lapse because it proves controls actually run, not just that they were documented on audit day.
The auditor confirms controls are documented and in place on a specific date. Faster to produce (6 to 12 weeks). Lower cost. Useful for startups needing to unblock a first enterprise deal. Not usually sufficient for repeat enterprise sales.
The auditor tests whether controls operated effectively over an observation window (3, 6, or 12 months). Preferred by procurement and security teams because it proves the controls were real, not just documented. Standard proof point for enterprise SaaS at any stage past seed.
Most SaaS companies release Type I first (to unblock deals) and then run a 6 to 12 month observation window toward Type II. The Type II report usually covers the first 6 months after the Type I date. By year two, teams drop Type I entirely and run Type II annually.
Minimum observation period is usually 3 months. Most buyers want 6 or 12 months. A 12-month report is the gold standard: it proves controls operated through the full fiscal year including holiday periods, personnel changes, and system updates.
A SOC 2 report is 40 to 100 pages. The headline is useful. The audit opinion, the system description, and the exceptions section are where real diligence happens.
The auditor opinion appears on page one. "Unqualified" or "unmodified" means the auditor confirmed everything. "Qualified" means something was not confirmed. "Adverse" or "disclaimer" means the auditor could not reach a conclusion. Enterprise buyers want unqualified.
The service org describes which systems, environments, and services were tested. If the production CRM is in scope but the staging environment is not, the report does not attest to staging. Buyers check that the systems they care about are inside the audit boundary.
The exceptions section lists any controls the auditor tested where they found a problem. A clean report has zero exceptions. A healthy report may have one or two with clear remediation. More than three exceptions, or any exceptions in critical controls (access review, MFA, incident response), is a reason to ask follow-up questions.
SOC 2 Type II reports are usually renewed annually. Between the end of the observation window and the next report, vendors provide a "bridge letter" attesting that controls continue to operate. Buyers accept the bridge letter during the gap. A missing bridge letter is a signal the vendor let compliance lapse.
Strkr is HIPAA compliant with a BAA available, GDPR and CCPA compliant, and SOC 2 Type II is targeted for 2026-Q4. Integration credentials are encrypted via AWS KMS and platform secrets live in AWS Secrets Manager.
SOC 2 is a security attestation report issued by an independent CPA firm that evaluates a service organization against the Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy. Enterprise SaaS buyers require it before signing contracts with vendors that handle their data.
Type I confirms controls were designed appropriately at a single point in time. Type II confirms they operated effectively over a 6 to 12 month observation window. Type II is the standard enterprise buyers expect. For a deeper breakdown, see /answers/what-is-soc-2-type-ii.
Any service organization that handles customer data and sells to enterprise buyers. SaaS companies, cloud providers, managed services, and data processors are the common examples. SOC 2 becomes a sales requirement once deals involve procurement and security review, typically starting around $25K to $50K ACV.
A Type I audit typically takes 6 to 12 weeks of preparation and testing. Type II adds a 6 to 12 month observation window during which controls must operate. Teams starting from scratch can realistically have a Type I in three months and a Type II roughly a year from kickoff.
Audit fees range from $20K to $80K per year depending on the auditor, scope, and company size. Add internal time (ownership of the program) and tooling (compliance automation platforms, security tools). Total first-year cost is often $50K to $150K. Renewals are cheaper because the controls and evidence pipeline already exist.
No. SOC 2 is an attestation. The auditor writes a report describing the controls and whether they operated as described. There is no stamp or certificate. Buyers want the report itself, not a logo. ISO 27001 is the certification equivalent and is more common in European and global sales.
Strkr has SOC 2 Type II in progress, targeting completion in 2026-Q4. In the meantime, Strkr is HIPAA compliant with BAA available, GDPR and CCPA compliant, and encrypts all integration credentials via AWS KMS. For sales-focused SOC 2 context, see /answers/what-is-soc2-sales.
No sales call, no migration consultant, no four-month implementation. Enter your card, get 14 days of the full Pro tier, cancel any time before day 14 with zero charge. Spin up a workspace, import your CSV, and have something useful before lunch.
