What Is a SOC 2 Report and Why Lawyers Should Ask for One

What is a SOC 2 report? A SOC 2 report is an independent audit, performed by a licensed CPA firm under AICPA standards, of how a service provider controls the security of the systems that hold its customers’ data. Lawyers ask for one because it is the most common written evidence that a software vendor’s security claims have been tested by someone other than the vendor.

For law firms and legal departments, that matters because client confidentiality now runs through outside software. ABA Formal Opinion 512 describes due diligence on AI vendors, including their security and data retention practices, as part of a firm’s supervisory duties. The opinion does not name SOC 2, but a SOC 2 report is one of the documents a vendor review commonly uses. This article explains the report. It is not legal advice.

What a SOC 2 Report Covers

SOC 2 reports are built on the AICPA’s Trust Services Criteria, which cover five categories: security, availability, processing integrity, confidentiality and privacy. Security is the core, and a vendor chooses which of the other four to include in scope. A report that covers only security says nothing directly about privacy controls, so the scope section is the first page worth reading.

The report itself includes the vendor’s description of its system, management’s assertion about its controls, and the auditor’s opinion. The AICPA’s guide to SOC 2 examinations, excerpted here, explains that the auditor tests whether controls meet the applicable criteria. SOC 2 reports are usually shared under a nondisclosure agreement. A SOC 3 report is a shorter public summary without the detailed test results.

SOC 2 Type 1 vs Type 2

The difference is time. According to the AICPA guide, a Type 1 report examines whether a vendor’s controls were suitably designed as of a single point in time. A Type 2 report also examines whether those controls operated effectively throughout a period, and it includes a detailed description of the auditor’s tests and their results.

That makes Type 2 the stronger evidence, because it shows controls working over months rather than existing on one day. Vendors often state which type they hold. OpenAI’s enterprise privacy page, updated January 8, 2026, says ChatGPT Business, ChatGPT Enterprise and its API platform have completed SOC 2 Type 2 audits. CosmoLex’s pricing page lists SOC 2 Type 2 controls in its security section.

Check the dates too. A Type 2 report covers a stated period, and a report whose period ended more than a year ago may no longer describe the current system. Vendors between reports often provide a bridge letter covering the gap.

What a SOC 2 Report Does Not Tell You

A SOC 2 report is not a certification, and it does not say a vendor is secure. It says an auditor tested specific controls against specific criteria over a specific period, and it lists any exceptions found. Reading the exceptions section, and the vendor’s response to each, is often more useful than the opinion itself.

Quality also varies. The AICPA’s SOC services page carries a notice that it is looking into anonymously published allegations about a compliance vendor offering SOC services, and in 2026 it published guidance on the risks of quick-turn SOC engagements, including a February 1 article titled “Promises of ‘fast and easy’ threaten SOC credibility.” The auditor’s name, licensing and peer review status are worth checking.

Finally, a report covers the vendor’s own systems. If a legal AI tool sends data to a third-party model provider, the report may carve that provider out, which means its controls were not tested. The report’s list of subservice organizations shows who else is in the chain. Our AI for lawyers guide covers the other terms to check.

Common Questions

Is SOC 2 a certification?

No. It is an attestation report from a CPA firm. Vendors sometimes describe themselves as SOC 2 certified, but the report is an auditor’s opinion on tested controls, not a certificate.

What is the difference between SOC 2 and ISO 27001?

SOC 2 is an AICPA attestation standard used mainly in the US. ISO 27001 is an international standard for information security management systems with formal certification. Some vendors hold both.

How do I get a vendor’s SOC 2 report?

Ask the vendor. Most share it after a nondisclosure agreement is signed, often through a trust portal.

Does a SOC 2 report satisfy a lawyer’s ethics duties?

The ethics opinions we have read do not say so. Opinion 512 describes vendor due diligence more broadly, including reading terms of use and data retention practices.

The Verdict

Real. A SOC 2 Type 2 report is the most useful single document in a legal tech security review, as long as the reader checks its scope, dates, exceptions and carve-outs. Our legal technology guide and glossary cover related terms.