SOC 2 Type II in a data room: what the report covers and what to ask for

“We’re SOC 2 compliant.” Almost every data room vendor says it, and in our data all 18 providers we score list SOC 2 in some form. The phrase on its own tells you very little.

What tells you a lot is the report behind it. This guide explains what that report contains, how Type II differs from Type I, where vendors’ claims tend to stretch, and how a deal lawyer or CFO with no audit background can read one in about twenty minutes.

What is SOC 2, in plain terms?

SOC 2 is an attestation framework run by the AICPA, the US accounting profession’s standards body. An independent CPA firm examines a service organisation’s controls against a set of criteria called the Trust Services Criteria and issues a report with its opinion.

It is not a certificate. Nobody “passes” SOC 2 the way a company is certified to ISO 27001. The output is a restricted-use report, typically 50 to 150 pages, written for customers and their auditors. Vendors share it under NDA.

There are five criteria categories. Security is mandatory in every SOC 2 examination; the other four are optional and chosen by the vendor.

For a data room, Security plus Confidentiality is a sensible minimum to look for, and Availability is a strong plus. A report that covers Security alone is still meaningful; it just answers fewer of your questions.

How does Type II differ from Type I?

This is the distinction that matters most, and vendors do not always volunteer which one they have.

A Type I report says “on 30 June, these controls existed and were sensibly designed”. A Type II report says “from January to December, we tested samples of these controls and here is how often they worked”. The second is evidence of habit, not intention.

A Type I is not worthless. A young vendor going through its first audit cycle will often have one, and it shows the controls are at least in place. But for a room holding a target company’s contracts, payroll and IP, Type II is the standard to expect, and enterprise buyers’ security teams will usually ask for it.

What is actually inside the report?

A SOC 2 report follows a fairly standard shape. Knowing the sections lets you skip to the parts that carry the weight.

1. The auditor’s opinion. A few pages. States whether the controls were suitably designed and, for Type II, operated effectively. Look for the words “unqualified” (clean), “qualified” (clean except for specific issues), “adverse” or “disclaimer”.
2. Management’s assertion. The vendor’s own statement that its description is fair. Short and formulaic.
3. The system description. The longest narrative section. It defines the scope: which product, which legal entity, which locations, which infrastructure, which subservice organisations such as the cloud host.
4. Criteria, controls, tests and results. The big table. Each control, how the auditor tested it, and the result, including any exceptions.
5. Other information. Optional. Often contains management’s responses to exceptions. Not covered by the auditor’s opinion.

Inside the system description, two short subsections deserve special attention: complementary user entity controls (what you, the customer, must do for the controls to work) and the list of subservice organisations, with a note on whether they are “carved out” or “included”.

How do you read a SOC 2 report in 20 minutes?

You do not need to read every control. Spend your time where the risk is.

1. Minutes 0 to 3: check the opinion and the period

   Open the auditor's report. Confirm it is Type II, note the start and end dates of the period, and check the opinion is unqualified. A qualified opinion is not an automatic no, but you need to know which criteria it relates to.

2. Minutes 3 to 9: read the scope

   In the system description, find which product, entity and locations are covered. Confirm the data room application itself is in scope, not just the company's corporate IT or the hosting provider. Note the criteria categories included.

3. Minutes 9 to 12: list the subservice organisations

   Find the cloud host and any other critical subprocessors. If they are carved out, their controls were not tested in this report; ask whether you can see their own SOC 2 reports.

4. Minutes 12 to 18: scan the exceptions

   Search the results table for 'exception' or 'deviation'. For each one, read what failed, how many samples were affected and management's response. Access-control and change-management exceptions matter more than a late training record.

5. Minutes 18 to 20: note your own obligations and the gap

   Copy the complementary user entity controls into your onboarding checklist. Then calculate how many months have passed since the period ended; if it is more than three, request a bridge letter.

That is enough for most deal processes. If your organisation has a formal vendor risk team, hand them the report with your notes; they will go deeper on specific controls.

Where do SOC 2 claims tend to stretch?

Most vendors are honest about SOC 2. The stretch is usually in what the claim leaves out.

Infrastructure-only reports. A data room provider might host on a major cloud platform that has its own SOC 2 Type II report, and point to that. The hosting provider’s report covers data centres, hardware and the cloud platform’s own staff. It says nothing about the vendor’s application code, its permission logic, its support staff’s access to your files or its incident response. It is a useful layer, but it is not the vendor’s own report.

Our fact sheet records exactly what each provider lists. Ellty, for example, lists SOC 2 at the infrastructure level and does not hold ISO 27001; most enterprise rooms such as iDeals, Datasite and Intralinks list SOC 2 alongside ISO 27001. Whatever a vendor lists, the same question applies: which entity and which systems does the report cover?

Carved-out subservice organisations. A carve-out is normal and does not mean anything is wrong. It does mean the report’s assurance stops at the boundary. You then rely on the subservice organisation’s own report.

Old periods. A Type II period that ended 14 months ago tells you about last year. Reports are usually renewed annually, so ask for the current one or the expected issue date.

Scope that skips the product. Occasionally a report covers a parent company’s corporate systems or a different product line. Check that the system name in the description matches the room you are buying.

What should you ask a data room vendor for?

Send this list early in your vendor review, ideally before you shortlist. A provider that answers quickly and fully is telling you something about its security culture.

• The full SOC 2 Type II report, not a summary, a logo or a SOC 3. Offer to sign their NDA.
• The period dates, and the expected date of the next report.
• A bridge letter if the period ended more than about three months ago.
• Confirmation the application is in scope, by name, with the legal entity that signs your contract.
• Subservice organisations’ reports for any carved-out hosting or critical subprocessors.
• Management’s response to each exception, if not already in the report.
• Other assurance, such as an ISO/IEC 27001 certificate with its statement of applicability, or a recent penetration test summary.

A SOC 3 report, by the way, is the public, general-use version. It confirms an examination happened and gives the opinion, but omits the detailed controls and test results. Fine for a first look; not enough for diligence.

How does SOC 2 compare with ISO 27001?

Buyers often ask which is “better”. They measure different things, and many enterprise rooms hold both.

ISO/IEC 27001 certifies that an organisation operates an information security management system meeting the standard, within a defined scope. Certification runs on a three-year cycle with annual surveillance audits. It is strong evidence of a functioning management system and a risk-based approach.

A SOC 2 Type II report is narrower and more granular. It tests named controls over a defined period and shows the results, including failures. If you want to know whether access reviews actually happened every quarter last year, SOC 2 Type II answers that; an ISO certificate does not show you the samples.

In practice: ISO 27001 tells you the vendor has a system for managing security. SOC 2 Type II shows you how that system performed. A European counterparty may ask for ISO first; a US counterparty’s security team will often ask for SOC 2 first.

Does a SOC 2 report make your room secure?

No, and the report says so itself, in the complementary user entity controls.

A typical list includes things like: the customer is responsible for granting and revoking user access, for reviewing user permissions periodically, for enforcing two-factor sign-in where it is optional, and for protecting its own administrator credentials. In a data room, those are exactly the settings that decide whether a bidder sees a folder it should not.

Most real leaks in deals come from configuration, not from a breach of the vendor’s platform. A room with a flawless SOC 2 Type II report and a permission group set too wide will still expose the wrong file. Our guide to data room security features covers the settings that do the work: per-group permissions, view-only mode, dynamic watermarks, document rights control and audit logs.

How much weight should SOC 2 carry when you choose?

A meaningful amount, but not all of it. In our rating method, Security carries 25% of each provider’s score, and certifications are one input to that check alongside two-factor login, watermarking, document rights management and the audit trail. A certificate that covers only the hosting provider counts for less than one covering the vendor’s own controls.

A practical rule for buyers:

• Standard private-company sale or fundraise. A current SOC 2 report covering the vendor’s service, plus sound in-room controls, is usually enough. Confirm scope.
• Private equity, regulated targets or listed counterparties. Expect your counterparty’s IT or vendor-risk team to ask for the full Type II report on the application, and often ISO 27001 too. Get the documents before you sign the room contract.
• Health data or other special categories. SOC 2 is not a substitute for sector rules. A room handling US protected health information also needs a business associate agreement under HIPAA.

Whatever the deal, ask early. A vendor review that starts after the room is live tends to end in an awkward migration.