Introduction to SOC 2

SOC 2 has become the de facto security standard for SaaS companies selling to enterprise customers. If you've been asked for a SOC 2 report — or you're wondering whether you need one — you're in the right place. This section breaks down the fundamentals: what SOC 2 actually is, what the report covers, which requirements apply to you, and what the Trust Service Criteria mean in practice.

SOC 2 Compliance Explained

What is SOC 2, exactly? Learn how the framework works, who it applies to, and why enterprise customers ask for it.

What is a SOC 2 Report?

Understand what a SOC 2 report looks like, what's inside it, and how to use it with prospects and customers.

SOC 2 Compliance Requirements

A breakdown of what you actually need to do to meet SOC 2 requirements — from policies to technical controls.

SOC 2 Trust Service Criteria

The five Trust Service Criteria explained — Security, Availability, Confidentiality, Processing Integrity, and Privacy.

SOC 2 Security Trust Service Criteria

Security is the only mandatory SOC 2 category. Here's what it covers and the controls you need to implement.