SOC 2 for SaaS companies is an independent CPA examination of the controls behind your hosted product, and the two decisions that shape it most are scope (which systems are in the report) and criteria (which Trust Services categories you include). Enterprise buyers read both before they read anything else.
What should be in scope for a SaaS SOC 2?
The scope of a SaaS SOC 2 is the system that delivers the service: infrastructure, software, people, procedures and data. Anything customers rely on in production belongs inside the boundary, and anything outside it needs a clear statement of why.
| Component | What it includes for a SaaS company |
|---|---|
| Infrastructure | Production cloud accounts, networks, databases, storage |
| Software | Application code, build and deployment pipeline, admin tools |
| People | Engineering, operations, support and anyone with production access |
| Procedures | Change, access, incident and vendor processes |
| Data | Customer data and how it flows, is stored and is deleted |
The AICPA defines the Trust Services Criteria as the criteria a SOC 2 examination evaluates, and the system description is where management states what the system includes. Our SOC 2 audit guide explains how the description turns this into text a buyer can read, and the SOC 2 compliance checklist covers scoping tasks.
Which Trust Services Criteria should a SaaS company choose?
Choose Security first, because it is mandatory, then add categories only where your customer commitments justify them. More categories mean more controls to operate and evidence, so extra scope should answer a real buyer need.
| Category | Common reason a SaaS company adds it |
|---|---|
| Security | Mandatory; protects the system against unauthorized access |
| Availability | Uptime commitments in contracts or SLAs |
| Confidentiality | Customers upload sensitive or contractually confidential data |
| Processing Integrity | Accuracy and completeness of processing is part of the product |
| Privacy | You collect personal information directly from individuals |
This pairing is common practice, not an AICPA rule; vertical examples include EdTech and AI companies. The Trust Services Criteria guide describes each category in full.
How is your cloud host handled in the report?
Your cloud host is typically a subservice organization, and SSAE 18, issued by the AICPA, requires management to monitor the controls of subservice organizations that are part of its control environment. The report treats it with the carve-out or the inclusive method.
- Carve-out: the host’s controls are excluded from testing, and the report refers customers to the host’s own assurance.
- Inclusive: the host’s relevant controls are described and tested as part of your report.
Most SaaS companies use carve-out for large public cloud hosts, then monitor the host’s report as evidence. Read our SSAE 18 guide for the details and cloud security audit for cloud-specific points.
What do enterprise buyers check in your SOC 2 report?
Buyers check the opinion, the period, the scope, the categories, carved-out vendors, complementary user entity controls and exceptions. A report that is clear on those points shortens the security review.
- Scope match: does the report cover the product they are buying?
- Currency: is the period recent, or is a bridge letter needed?
- CUECs: controls the customer must run, such as removing access for departed employees.
- Exceptions: which controls, how many and how management responded.
Preview that review yourself with how to read a SOC 2 report, and prepare for the questionnaires that often come with it in SOC 2 and security questionnaires.
What does multi-tenancy change for a SaaS SOC 2?
Multi-tenancy changes how you explain logical separation of customer data, not which criteria apply. Auditors look for how one customer is prevented from reaching another’s data, how access is granted to support staff and how changes reach every tenant at once.
- Logical separation: describe how tenants are isolated in the application and data layer.
- Support access: show who can view customer data, how it is approved and how it is logged.
- Releases: one change can affect every tenant, so approvals and testing matter more.
- Data deletion: explain what happens to a tenant’s data when a contract ends.
These are examples from common practice; the criteria set outcomes and management designs the controls.
How do you keep evidence audit-ready in a fast-moving SaaS team?
Build evidence into the workflow you already use. Pull requests, tickets, deployment logs and access-review records can be the proof, as long as they are dated, owned and retained for the whole observation period.
- Require peer review and approval for production changes in the code platform.
- Run access reviews on a schedule, with a named reviewer and a saved sign-off.
- Track onboarding and offboarding in tickets that show dates.
- Keep vendor reviews and incident records in one place.
Automation can collect much of this; see compliance automation tools. Tools gather evidence, but the CPA firm still tests and gives the opinion.
Next Assurance defines scope, categories and subservice treatment so your report matches what buyers review. See our SOC 2 audit service.
Frequently asked questions about SOC 2 for SaaS companies
Does a SaaS company need SOC 2?
No law requires it, but enterprise customers commonly ask SaaS vendors for a report during security review. Whether you need one depends on who buys from you. Ask your largest prospects what they require before committing, since the answer determines category choice, report type and timing.
Which SOC 2 categories do SaaS companies choose?
Security is mandatory. Many SaaS companies also include Availability when contracts promise uptime and Confidentiality when customers store sensitive data. Processing Integrity and Privacy are added when accuracy of processing or direct collection of personal information is part of the service. Add categories because commitments require them.
Is AWS or another cloud host covered by my SOC 2?
Usually not directly. A cloud host is generally a subservice organization handled by the carve-out method, which excludes its controls from testing while your report lists the assumptions. Customers then read the host’s own report too. The inclusive method includes the host’s controls but needs its cooperation.
What are CUECs and why do SaaS buyers care?
Complementary user entity controls are controls the service organization assumes customers will operate for the criteria to be met, such as promptly deactivating departed employees’ accounts. Buyers care because these show what they are responsible for, and a customer who skips them may not get the protection the report describes.
Type I or Type II for a SaaS company?
Type I tests that controls are suitably designed at one date, while Type II also tests that they operated effectively over a period. Buyers often prefer Type II, but a Type I can be a practical first report when a deal is waiting. Confirm with your prospects which they accept.
How often should a SaaS company renew SOC 2?
The AICPA’s standards set no expiry for a SOC 2 report, but buyers commonly treat it as current for about 12 months from the end of the audit period. Most SaaS companies renew annually with continuous controls, and use a bridge letter if a gap appears between periods.
Sources
Facts checked against the sources below on October 7, 2026. Category pairings and evidence habits reflect common practice; the AICPA criteria do not prescribe specific controls.
- AICPA & CIMA – 2017 Trust Services Criteria (With Revised Points of Focus – 2022): the criteria and categories a SOC 2 examination evaluates.
- AICPA & CIMA – System and Organization Controls: SOC Suite of Services: the AICPA’s overview of SOC 1, SOC 2 and SOC 3 reports.
- AICPA & CIMA – Statement on Standards for Attestation Engagements No. 18: the attestation standard that governs SOC examinations and subservice organizations.
