What is SOC 2?
SOC 2 is an independent auditor's report on a service company's controls, based on AICPA criteria covering security, availability, processing integrity, confidentiality and privacy.
In more detail
A licensed CPA firm writes the report. Security is always in scope, and the other four categories are optional. Reports come as Type I (controls were designed appropriately at a point in time) and Type II (controls operated over a period, commonly six to twelve months). Type II tells you more. When a vendor mentions SOC 2, ask for the report under NDA, then read the scope, the audit period and any exceptions noted. A report for one product does not cover everything the company does. SOC 2 is an attestation, not a certification in the strict sense, and it says nothing about whether a specific project is secure, so architecture and access reviews still apply.
Example
Before approving an AI vendor, a security team reads its Type II report and notices the audited system excludes the new voice product. They ask for compensating controls before sending call data.