Blog
SOC 2 reports and document security in the cloud
CTO / Head of Engineering, AODocs · May 16, 2023 · Updated Oct 6, 2026
AODocs previously announced an independent SOC 2 examination. This historical announcement does not establish the scope, period, findings, or opinion of a current report.
What is a SOC 2 report?
SOC 2 is an independent assurance examination and report on controls relevant to selected trust services criteria. The report identifies its system scope, criteria, period or date, and practitioner opinion. It is not a general security certification.
Organizations can consider a SOC 2 report as one input to supplier risk and compliance assessment. Review the actual report, its scope, exceptions, and complementary user controls. A report does not establish compliance with every law or standard.
What does an independent examination assess?
The historical announcement names independent firm Kirkpatrick Price as the auditor. Buyers should obtain the relevant report and inspect its system boundary, selected criteria, period, opinion, and any exceptions rather than infer coverage of every product or hosting component.
A SOC 2 examination requires defined scope and supporting evidence. The article’s historical announcement does not substantiate an exclusive market position. When using a document platform, assess its controls and operating responsibilities against the actual audit requirements.
Why obtain a SOC 2 report?
An independent examination can provide information about defined controls for supplier assessment. Buyers still need to review the report and their own deployment responsibilities. Historical assurance does not guarantee that data is safe in every present configuration.
Why should customers review SaaS assurance reports?
Customers should examine the selected criteria, service boundary, reporting period, opinion, exceptions, and complementary user controls. A SOC 2 report can inform an assessment of cloud-service risk; it does not guarantee the confidentiality level required by every organization.
Frequently asked questions
Is SOC 2 a certification or an assurance report?
SOC 2 is an independent assurance examination that results in a report on controls within a defined system and scope. It is commonly described as certification in marketing, but the report, its criteria, and its coverage are what a buyer should review. A historical announcement does not establish the provider's current report period or findings.
What should a buyer check in a cloud provider's SOC 2 report?
A buyer should review the system boundaries, trust services categories, report type and period, auditor's opinion, exceptions, and responsibilities assigned to customers or other service providers. Check whether the service being purchased is inside the assessed scope. A SOC 2 label alone does not describe every control or the customer's own configuration.
Does a SOC 2 report prove compliance with every data-protection law?
No. SOC 2 evaluates controls against the trust services criteria included in the examination. It does not by itself establish compliance with every privacy, records, or sector-specific requirement. Use the report as one input to due diligence, alongside contractual terms, the intended use, and the legal obligations that apply to the customer.
Can an old SOC 2 announcement establish a provider's current assurance?
No. A historical announcement establishes only what was reported at that time. For current due diligence, request the relevant SOC 2 report and check its scope, covered period, and any subsequent assurance information. Do not infer present controls, a clean opinion, or exclusive market status from the original blog post.
