Definition
SOC 2 is a report from an independent CPA on a service organization's system-level controls, developed by the AICPA. It gives customers information to assess the risks of outsourcing services. Buyers of HR and payroll software often request a SOC 2 report to evaluate how a vendor protects employee data.
Also known as: SOC 2 report, SOC2, System and Organization Controls 2
How it works
SOC is a suite of service offerings that CPAs may provide in connection with an organization's system-level controls. A SOC 2 engagement is an examination of controls at a service organization. The resulting report helps users assess and address the risks associated with outsourcing services.
SOC 2 reporting addresses controls relevant to security, availability, processing integrity, confidentiality, and privacy. The vendor chooses which of these categories fall within the scope of its report, so scope varies between vendors.
The AICPA promulgates the professional standards for SOC engagements and advises that SOC services be thoroughly evaluated by service organizations and CPA firms. For HR buyers, the practical step is to request the current report under a nondisclosure agreement, confirm which categories and systems are in scope, and review any exceptions noted by the auditor.
Example
A mid-size employer evaluating a payroll vendor requests its latest SOC 2 report. The security team checks that the payroll processing system is in scope and reads the auditor's noted exceptions before approving the contract.
Free checklist
Buyer's checklist: HRIS Software
Everything to check before you sign with a HRIS provider, on one printable page.
- 9 questions to ask every vendor, with how to verify each answer
- 11 capabilities to confirm in a demo
- 6 pricing questions about fees outside the quote
- A scorecard of the 5 products we rank highest, with what we verified
Facts as of Oct 24, 2026 · LeadChange Research Team
What it checks
- Employee record model
- Payroll integration
- Onboarding and document management
- Time off and absence rules
- Reporting and data access
- Integration breadth and API
- Permissions and privacy controls
- Employee and manager self-service
and 1 more question in the full checklist
Sample question
Employee record model
Ask to see a rehire and a mid-year transfer, and view the full change history on the record.
Frequently asked questions
What is a SOC 2 report?
A SOC 2 report is the result of an examination of controls at a service organization, performed by a CPA under AICPA standards. It helps customers assess the risks of outsourcing services to that organization, particularly where the vendor handles sensitive data.
What areas does SOC 2 cover?
SOC 2 reporting addresses controls relevant to security, availability, processing integrity, confidentiality, and privacy. The service organization determines which of these are included in its report, so buyers should check that the scope matches the systems and data they will use.
Is SOC 2 a certification?
It is an attestation report issued by an independent CPA firm, not a government license. The AICPA cautions that SOC services should be thoroughly evaluated and warns against promises of fast and easy reports, so buyers should review scope and auditor findings rather than rely on a logo.
Is ISO 27001 the same as SOC 2?
No. ISO/IEC 27001 is an international standard for running an information security management system, and a company may choose to be certified against it by a certification body. SOC 2 is an attestation report in which an independent CPA examines a service organization’s controls under AICPA standards. Many HR vendors hold both, and buyers often ask for each.
What is the difference between SOC 1 and SOC 2?
A SOC 1 report covers controls at a service organization that matter to its customers’ internal control over financial reporting, which is why payroll processors often provide one. A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality or privacy, the areas most HR software buyers review.
Which HR software vendors have a SOC 2 Type II report?
About half of the HR software products we track state a SOC 2 Type II report on their own pages, among them Rippling, Deel, BambooHR, HiBob, Paylocity, Greenhouse and Checkr. Each product page shows the statement and its source; ask the vendor for the current report under a nondisclosure agreement before you sign.
Compare HR compliance options
See every HR compliance product we rank, with verified prices and features.