SOC 2 has become the de facto security standard for SaaS companies selling to enterprise customers. If you've been asked for a SOC 2 report — or you're wondering whether you need one — you're in the right place. This section breaks down the fundamentals: what SOC 2 actually is, what the report covers, which requirements apply to you, and what the Trust Service Criteria mean in practice.