SOC 2

SOC 2 is an examination, carried out by an independent certified public accountant (CPA), of the controls at a service organization. It's one of the AICPA's System and Organization Controls (SOC) services, and covers controls relevant to security, availability, processing integrity, confidentiality or privacy (AICPA SOC 2).

What it is

The examination measures the controls against the AICPA's Trust Services Criteria, and the report says which of the five categories it covers.

There are two report types:

• Type 1 looks at whether the controls are suitably designed, at a point in time.
• Type 2 also tests whether the controls operated effectively over a period.

A Type 2 report shows the controls working, not just written down, which is why buyers' security teams tend to ask for it.

Why it matters

Buyers in regulated or security-minded companies often need a SOC 2 report from every vendor that handles their code or data. It replaces a long security questionnaire with an independent opinion.

In AI CodeOps

AI CodeOps isn't SOC 2 certified and doesn't claim to be. The Trust page lists the controls in place today and the subprocessors used.

What you can use in your own audits: the audit log of workspace actions, and signed evidence packs that record how each change was made, reviewed, approved and deployed.