SOC 2 Type II (also written SOC 2 Type 2) is an independent CPA firm's report on whether a service provider's controls for protecting customer data were suitably designed and actually operated effectively over a defined period, measured against the AICPA's Trust Services Criteria. It is an attestation, not a certificate: the output is an auditor's opinion plus the tests behind it, not a pass or fail badge.
What is the difference between SOC 2 Type I and Type II?
Type I checks the design of controls on a single date. Type II checks that the same controls kept working across a period of months.
A period with a start and end date
Whether controls are suitably designed
Whether controls are suitably designed and operated effectively
The controls exist on paper and in setup
The controls ran, and where they failed (exceptions)
Companies often complete a Type I first, then a Type II once they have operating history to test.
What is the difference between SOC 2 Type I and Type II?
The trust services criteria are the AICPA's five categories a SOC 2 report can cover. Security is in every SOC 2 report. The company chooses whether to add the other four.
Security: systems and data are protected against unauthorized access and changes.
Availability: the system is available for operation and use as committed.
Processing integrity: processing is complete, valid, accurate, timely, and authorized.
Confidentiality: information designated as confidential is protected.
Privacy: personal information is collected, used, kept, shared, and disposed of in line with the company's commitments.
Two vendors can both say "SOC 2 Type II" and cover different categories, so check the scope before comparing.
How long is a SOC 2 Type II audit period?
Audit periods commonly run from 3 to 12 months. The report only speaks to that window, so read the exact start and end dates. To cover the gap between the period end and the next report, vendors often issue a bridge letter (or gap letter): management's statement that no material control changes have happened since. The vendor writes it, not the auditor, so it does not replace the report.
How do you read a vendor's SOC 2 Type II report?
Start with the opinion and the dates, then read the parts that move risk back to you:
Auditor's opinion. An unqualified opinion means the auditor found the description fair and the controls effective. A qualified opinion flags a material problem.
Audit period. If it ended a while ago, ask for the bridge letter and the next report date.
System description and scope. Confirm the product you are buying is inside the scope, not just the vendor's corporate IT.
Categories in scope. Security only, or security plus availability, confidentiality, or others?
Exceptions. Read every failed test and the vendor's response. Repeated exceptions in access or change management deserve follow-up.
Subservice organizations. Cloud hosts and other providers are often "carved out," meaning their controls were not tested. Ask for their own SOC 2 reports.
Complementary user entity controls (CUECs). Controls the report assumes you run, such as removing departed users. Skip them and the vendor's controls do not fully protect you.
SOC 2 reports are restricted-use documents, usually shared under NDA. A SOC 3 is a shorter general-use version a vendor can publish, but it leaves out the test detail above.
Why does SOC 2 Type II matter for AI voice agents?
A voice agent platform handles call recordings, transcripts, and the personal data callers say out loud, and that data can pass through telephony, speech, and language model providers. That makes subservice organizations matter more than usual. Pair the SOC 2 review with two other questions: where the data is stored (data residency) and whether any provider keeps it after the call (zero data retention).
SOC 2 also has limits. It does not test how accurate an AI agent is, and it does not replace a HIPAA business associate agreement or a GDPR data processing agreement. For the wider picture, see compliance for AI voice agents, the enterprise voice AI compliance guide, and HIPAA compliance for AI phone agents.
What does Retell's SOC 2 cover?
Retell's security and compliance documentation lists SOC 2 Type 1 and Type 2, with independently audited controls for security, availability, and confidentiality. Certificates, reports, and the latest audit status are in the Retell Trust Center. Ask for the Type 2 report and run it through the checklist above.
Some controls sit on your side. In Retell, for example, you set the data retention period per agent, from 1 day to 2 years or no automatic deletion, and that choice is yours to make and document. For subprocessor lists or a custom security review, the docs direct buyers to support@retellai.com.
If your security team is reviewing voice AI vendors, see how Retell supports regulated deployments on the enterprise conversational AI platform page.
Security & compliance for regulated deployments
How Retell handles audits, data retention and access control.
Further Reading
Zero Data Retention
A setup where the provider keeps no copy of call content after processing it.
Data Residency
What data residency means, how it differs from data sovereignty, and what to ask an AI voice agent vendor about where call data is stored.
Compliance
Acknowledge the importance of Compliance for AI voice agents; adhering to legal, security, and privacy standards is vital for growth in regulated sectors.
Related terms
Guide
Enterprise voice AI compliance guide
Guide
HIPAA compliance for AI phone agents
