SOC 2
SOC 2
ELI5 — The Vibe Check
SOC 2 is a trust certification for SaaS companies. It proves to enterprise customers that you take security, availability, and privacy seriously. An independent auditor reviews your controls and certifies you pass. Big companies won't sign contracts with SaaS vendors without SOC 2. It's basically security street cred.
Real Talk
SOC 2 (System and Organization Controls 2) is an auditing standard developed by the AICPA. It evaluates controls relevant to the Trust Services Criteria: Security, Availability, Processing Integrity, Confidentiality, and Privacy. Type I covers a point in time; Type II covers a period (typically 6-12 months) and is more rigorous.
When You'll Hear This
"Our enterprise prospects require SOC 2 Type II before signing." / "We're going through the SOC 2 audit process — it takes about 6 months."
Related Terms
Compliance
Compliance means following the rules — legal, industry, or governmental standards that say how you must handle data and security.
GDPR (GDPR)
GDPR (General Data Protection Regulation) is the EU's big rulebook for protecting people's personal data.
MFA (MFA)
MFA stands for Multi-Factor Authentication. It's the umbrella term for requiring multiple proofs of identity. 2FA is MFA with exactly two factors.
PCI DSS (PCI DSS)
PCI DSS is the security standard you must follow if you handle credit card data.
Security Audit
A security audit is a systematic review of your code, infrastructure, and processes to find security weaknesses.