SOC 2 Type II: reading a vendor report without being sold a story

Your cloud vendor displays “SOC 2 certified” on its home page, blue badge and all. One small detail: SOC 2 certification does not exist. SOC 2 is an attestation report governed by the AICPA, the American institute of certified public accountants. An independent CPA firm examines the vendor’s controls, then expresses a professional opinion in a document that often runs to dozens of pages. Nobody awards a seal, nobody “passes” SOC 2: you obtain a report, with its strengths and its reservations.

The distinction is not pedantry. A certification such as ISO 27001 produces a public certificate, valid for a set period. A SOC 2 report is a confidential document the vendor hands over on request, usually under a non-disclosure agreement. It describes the system audited, the controls tested, the test results and the exceptions noted. That level of detail is exactly what makes it useful: the badge on the website tells you nothing, the full report tells you everything. A public, summarized version does exist, called SOC 3, and it is rarely enough for a business decision.

In practice, if you run IT at an SME in Granby and you are shopping for cloud payroll software, the right question is not “do you have SOC 2?” but “can you send me your most recent SOC 2 Type II report?” The reaction is already telling: a serious vendor has an established process for sharing it.

The report assesses the vendor’s controls against the trust services criteria defined by the AICPA. There are five of them.

What many executives do not realize: only the security criterion is mandatory. The other four are optional, at the vendor’s discretion. A SOC 2 report can therefore be perfectly genuine while covering neither confidentiality nor privacy. Before you feel reassured, check which criteria are in scope: for an AI tool processing your clients’ or your employees’ personal information, a report limited to security leaves large blind spots.

A Type I report answers the question: were the controls well designed on such-and-such a date? That is a photograph. The auditor observes that the policies exist, that encryption is configured and that access is documented, on one particular day. A Type II report answers a far more demanding question: did those controls actually operate throughout the observation period, generally 3 to 12 months? That is a film. The auditor tests samples of logs, access requests and incident reports to check that each control was carried out week after week.

The practical difference is enormous. A company can obtain a Type I in a few weeks with impeccable documentation and an embryonic implementation. Type II does not take makeup: if the quarterly access review never happened, the exception appears in the report. That is why Type II is the only report that attests how the controls really worked. When a vendor stays vague about which type it holds, prudence says assume Type I, or an audit still in progress.

Receiving the report is only half the work. A controller handed an 80-page PDF instinctively files it and ticks the “vendor audited” box. Resist: four checks take less than an hour and often change the conclusion.

Those four readings turn a marketing badge into management information, and they document your diligence if an incident happens at the vendor.

Both frameworks come up constantly in tenders, and they are often confused. ISO/IEC 27001 certifies an information security management system (ISMS): the organization has put governance, risk management and continuous improvement in place, verified by an accredited certification body on a 3-year cycle with annual surveillance audits. SOC 2, for its part, produces a detailed opinion on specific controls applied to the data clients entrust to the vendor, observed over a given period.

Neither is “better”: they answer different questions. ISO 27001 says “this vendor manages security in a structured way”; a SOC 2 Type II says “here is the detailed evidence that its controls operated from this date to that date.” Mature vendors often hold both. To assess a processor that will host your data, the SOC 2 Type II report is the richest document to read; the ISO 27001 certificate is the simplest signal to verify.

Even the most favourable report is silent on three matters that weigh heavily in Quebec. First, jurisdiction. SOC 2 assesses controls, not laws. An American-owned vendor can hold a flawless Type II and remain subject to the CLOUD Act, the 2018 American statute that lets US authorities demand data even when it is stored in Canada. The physical location of the servers is no protection: what counts is the owner’s jurisdiction, and no audit changes that reality.

Second, AI model training. The report attests controls against the commitments the vendor describes; if those commitments say nothing about using your data to train its models, the report will say nothing either. Yet under Law 25, reusing personal information to train a model amounts to a new purpose that needs its own legal basis. The no-training guarantee has to be in the contract, in black and white, not inferred from a logo.

Third, your own legal obligations. Law 25 requires you to govern your processors by contract (section 18.3) and to carry out an assessment before any disclosure of personal information outside Quebec (section 17). A SOC 2 report is excellent material to file with that assessment, but it does not replace it. The auditor never claimed to check your Quebec compliance.

Require a recent SOC 2 Type II as soon as a vendor hosts or processes personal information, financial data or trade secrets on your behalf: SaaS platforms, AI tools, payroll services, hosts, IT subcontractors. In a tender, specify “Type II,” the minimum period expected and the trust services criteria required, otherwise you will harvest ambiguous answers.

Stay proportionate, though. A SOC 2 Type II audit is expensive in time and fees; your 12-person regional integrator probably will not have one, and that is not necessarily disqualifying. Alternatives exist: a detailed security questionnaire, solid contractual clauses (data residency, incident notification timelines, no training, reversibility), a right to audit, or an architecture that avoids the transfer altogether. That is the logic of sovereign hosting: when the AI and the data stay inside your environment, the vendor’s audit report loses much of its weight.

For transparency: Cogio holds no SOC 2 report and claims no certification. What we deliver instead is a timestamped evidence register (audit logs, flow mapping, documented decisions) that belongs to the client, and we apply the reading grid described here to our own suppliers.

Draw up the list of vendors that touch personal information or strategic data: the register Law 25 requires already gives you most of it. For each one, ask for the most recent SOC 2 Type II report, apply the four checks (period, opinion, exceptions, subcontractors) and record the outcome. The holes you find (expired reports, Type I presented as certification, hosts carved out of scope) become negotiating points at the next renewal.

If you would rather have an outside eye, our approach starts with exactly that kind of audit of data flows and vendors, with a Law 25 grid built in. You come away with a clear picture and precise questions to put to each vendor. The 12-step compliance checklist is also a good starting point for placing third-party assessment among all your obligations.