Revolutionize your call operation with Retell
SOC 2 Type II is an auditor's report on whether a vendor's controls worked over a set period. See Type 1 vs Type 2, the 5 criteria, and how to read one.
SOC 2 Type II (also written SOC 2 Type 2) is an independent CPA firm's report on whether a service provider's controls for protecting customer data were suitably designed and actually operated effectively over a defined period, measured against the AICPA's Trust Services Criteria. It is an attestation, not a certificate: the output is an auditor's opinion plus the tests behind it, not a pass or fail badge.
Type I checks the design of controls on a single date. Type II checks that the same controls kept working across a period of months.
| SOC 2 Type I | SOC 2 Type II | |
|---|---|---|
| Time covered | One date ("as of") | A period with a start and end date |
| What the auditor tests | Whether controls are suitably designed | Whether controls are suitably designed and operated effectively |
| What it tells a buyer | The controls exist on paper and in setup | The controls ran, and where they failed (exceptions) |
Companies often complete a Type I first, then a Type II once they have operating history to test.
The trust services criteria are the AICPA's five categories a SOC 2 report can cover. Security is in every SOC 2 report. The company chooses whether to add the other four.
Two vendors can both say "SOC 2 Type II" and cover different categories, so check the scope before comparing.
Audit periods commonly run from 3 to 12 months. The report only speaks to that window, so read the exact start and end dates.
To cover the gap between the period end and the next report, vendors often issue a bridge letter (or gap letter): management's statement that no material control changes have happened since. The vendor writes it, not the auditor, so it does not replace the report.
Start with the opinion and the dates, then read the parts that move risk back to you:
SOC 2 reports are restricted-use documents, usually shared under NDA. A SOC 3 is a shorter general-use version a vendor can publish, but it leaves out the test detail above.
A voice agent platform handles call recordings, transcripts, and the personal data callers say out loud, and that data can pass through telephony, speech, and language model providers. That makes subservice organizations matter more than usual. Pair the SOC 2 review with two other questions: where the data is stored (data residency) and whether any provider keeps it after the call (zero data retention).
SOC 2 also has limits. It does not test how accurate an AI agent is, and it does not replace a HIPAA business associate agreement or a GDPR data processing agreement. For the wider picture, see compliance for AI voice agents, the enterprise voice AI compliance guide, and HIPAA compliance for AI phone agents.
Retell's security and compliance documentation lists SOC 2 Type 1 and Type 2, with independently audited controls for security, availability, and confidentiality. Certificates, reports, and the latest audit status are in the Retell Trust Center. Ask for the Type 2 report and run it through the checklist above.
Some controls sit on your side. In Retell, for example, you set the data retention period per agent, from 1 day to 2 years or no automatic deletion, and that choice is yours to make and document. For subprocessor lists or a custom security review, the docs direct buyers to support@retellai.com.
If your security team is reviewing voice AI vendors, see how Retell supports regulated deployments on the enterprise conversational AI platform page.