Definition
SOC 2 is a report from an independent CPA on a service organization's system-level controls, developed by the AICPA. It gives customers information to assess the risks of outsourcing services. Buyers of HR and payroll software often request a SOC 2 report to evaluate how a vendor protects employee data.
Also known as: SOC 2 report, SOC2, System and Organization Controls 2
How it works
SOC is a suite of service offerings that CPAs may provide in connection with an organization's system-level controls. A SOC 2 engagement is an examination of controls at a service organization. The resulting report helps users assess and address the risks associated with outsourcing services.
SOC 2 reporting addresses controls relevant to security, availability, processing integrity, confidentiality, and privacy. Scope differs between reports, so read which systems and categories each one covers.
The AICPA promulgates the professional standards for SOC engagements and advises that SOC services be thoroughly evaluated by service organizations and CPA firms. For HR buyers, the practical step is to request the current report under a nondisclosure agreement, confirm which categories and systems are in scope, and review any exceptions noted by the auditor.
Example
A mid-size employer evaluating a payroll vendor requests its latest SOC 2 report. The security team checks that the payroll processing system is in scope and reads the auditor's noted exceptions before approving the contract.
Free checklist
Buyer's checklist: HRIS Software
Everything to check before you sign with an HRIS provider, on one printable page.
- 9 questions to ask every vendor, with how to verify each answer
- 11 capabilities to confirm in a demo
- 6 pricing questions about fees outside the quote
- A scorecard of the 5 products we rank highest, with what we verified
- Scored: BambooHR, Zoho People, Namely, Rippling, and Leapsome
Facts as of Nov 5, 2026 · LeadChange Research Team
What it checks
- Employee record model
- Payroll integration
- Onboarding and document management
- Time off and absence rules
- Reporting and data access
- Integration breadth and API
- Permissions and privacy controls
- Employee and manager self-service
and 1 more question in the full checklist
Sample question
Employee record model
Ask to see a rehire and a mid-year transfer, and view the full change history on the record.
Frequently asked questions
What is a SOC 2 report?
A SOC 2 report is the result of an examination of controls at a service organization, performed by a CPA under AICPA standards. It helps customers assess the risks of outsourcing services to that organization, particularly where the vendor handles sensitive data.
What areas does SOC 2 cover?
SOC 2 reporting addresses controls relevant to security, availability, processing integrity, confidentiality, and privacy. Buyers should check that the report's scope covers the systems and data they will use.
Is SOC 2 a certification?
It is an attestation report issued by an independent CPA firm, not a government license. The AICPA emphasizes that SOC services should be thoroughly evaluated, so buyers should review scope and auditor findings rather than rely on a logo.
Is ISO 27001 the same as SOC 2?
No. ISO/IEC 27001 is an international standard for running an information security management system, and a company may choose to be certified against it by a certification body. SOC 2 is an attestation report in which an independent CPA examines a service organization’s controls under AICPA standards. Many HR vendors hold both, and buyers often ask for each.
What is the difference between SOC 1 and SOC 2?
The AICPA describes SOC 1 as an examination of controls at a service organization that are likely to be relevant to its customers’ internal control over financial reporting. A SOC 2 report covers controls relevant to security, availability, processing integrity, confidentiality or privacy, the areas most HR software buyers review.
Which HR software vendors have a SOC 2 Type II report?
Products we track that state a SOC 2 Type II report on their own pages include Rippling, Deel, BambooHR, HiBob, Paylocity, Greenhouse and Checkr. Each product page shows the statement and its source; ask the vendor for the current report under a nondisclosure agreement before you sign.
Compare HR compliance options
See every HR compliance product we rank, with the features we verified and how each one is priced.
Sources
The 3 pages this page's facts come from. The date beside each is our last check of the facts taken from it (the oldest, when they differ).