How it works
A SOC 2 report covers one or more Trust Services Criteria: security, availability, processing integrity, confidentiality and privacy. A Type I report assesses whether controls are designed properly at a point in time; a Type II report tests whether they operated effectively over a period, typically six to twelve months. Reports are shared under NDA, and buyers review the scope, exceptions and subservice organizations.
Example
Before signing, a bank's vendor risk team requests a provider's SOC 2 Type II report, checks that the integration service is in scope, and reviews any exceptions the auditor noted.
In integrations
Integration providers hold credentials and financial data for your customers, so their controls matter. Unify Int does not claim certifications it does not hold. Its security practices and current compliance status are on the Trust page, and security documents can be requested there. A SOC 2 report is evidence about controls, not a guarantee. Read the scope, the period and any exceptions, and confirm the services you will use are covered.