SOC 2

SOC 2 is an auditing framework from the American Institute of CPAs (AICPA) under which an independent auditor reports on a service organization’s controls related to security, availability, processing integrity, confidentiality, and privacy.

A SOC 2 report comes in two forms: Type I assesses control design at a point in time, while Type II tests how effectively those controls operated over a period, typically several months.

It is a common requirement in enterprise procurement, where buyers ask vendors — including AI-agent providers — to demonstrate audited security controls.