SOC 2

General definition

SOC 2 (System and Organization Controls 2) is a reporting framework created by the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines a service organisation’s controls against the Trust Services Criteria and issues a report containing its opinion. Security, known as the common criteria, is always in scope; availability, processing integrity, confidentiality and privacy are added when they are relevant to the service.

The two report types answer different questions:

• Type I describes the controls and whether they are suitably designed at a single point in time
• Type II also tests whether the controls operated effectively over a review period, usually six to twelve months, and lists any exceptions the auditor found
• A SOC 3 is a short, general-use summary of a Type II that can be published; the full SOC 2 report is normally shared under NDA

SOC 2 is not a certification and there is no pass or fail badge. The report contains the auditor’s opinion, management’s description of the system, the controls tested and the results, so a buyer’s security team reads it rather than ticking a box. A useful reading order is the opinion, the scope (which services, locations and criteria), the exceptions, and the complementary user entity controls, which list what the customer must do for the provider’s controls to work. Because it describes one provider’s controls, it does not transfer: a vendor built on a cloud that has a SOC 2 report does not inherit that report.

It relates to other frameworks without replacing them. ISO 27001 is a certification against an international standard for an information security management system; the certificate is public and the control mapping overlaps heavily with SOC 2, so many providers hold both. HIPAA is a law with no certification at all; a SOC 2 report can evidence safeguards, but a Business Associate Agreement is still required. Audit logs, log retention, access reviews and change management are the control areas most report readers look at first.

In the Ethora ecosystem

Ethora does not currently hold a SOC 2 report, and this page should not be read as claiming one. What Ethora offers instead is a deployment model that keeps the controls in your hands: on a dedicated or self-hosted deployment the chat server, database and files run inside your own cloud account or data centre, so they sit within the environment your organisation already audits, whether that is your own SOC 2 scope, your ISO 27001 management system or your HIPAA risk analysis. Ethora provides the technical building blocks those programmes expect: TLS in transit, encryption at rest, role-based access, a compliance audit trail with immutable log export, configurable retention and data residency by region.

For any vendor, Ethora included, the right due-diligence question is not whether a logo appears on a website but what the current report or equivalent evidence actually covers. Ask for the report and its date, the criteria in scope, the exceptions and the customer-side controls. On a self-hosted deployment you can also read the source code, because the platform is open source.