# SOC 1 vs SOC 2: which do you need?

Understand the key differences between SOC 1 and SOC 2 certifications, and determine which one is right for your business.

## Quick answer

SOC 1 is for companies that affect their clients' financial statements (like payroll processors). SOC 2 is for companies that store, process, or transmit customer data (like SaaS companies).

Most technology companies need SOC 2. If you're building software, providing cloud services, or handling customer data, SOC 2 is almost certainly the right choice.

## SOC 1 vs SOC 2: detailed comparison

| Aspect | SOC 1 | SOC 2 |
| --- | --- | --- |
| Primary focus | Financial reporting controls | Security, availability, processing integrity, confidentiality, privacy |
| Who needs it | Companies that impact client financial statements (payroll, payment processors) | SaaS companies, cloud providers, any company handling customer data |
| Audit standard | SSAE 18 (AT-C 320) | SSAE 18 (AT-C 205) + Trust Services Criteria |
| Report recipients | User entities and their auditors (restricted distribution) | Customers, prospects, stakeholders (broader distribution) |
| Common industries | Payroll, accounting, financial services, data centers | SaaS, cloud, technology, healthcare, any B2B software |
| Regulatory driver | Sarbanes-Oxley (SOX) compliance for clients | Customer requirements, enterprise sales, security posture |

## When to choose each

Common use cases for SOC 1 and SOC 2

### SOC 1 - Choose if you...
- Payroll processing companies
- Payment processing services
- Loan servicing companies
- Data center hosting (financial data)
- Claims processing services
- Investment management platforms

### SOC 2 - Choose if you...
- SaaS and cloud applications
- Managed IT services
- Customer data management
- Healthcare technology
- HR and recruiting software
- Any B2B technology company

## Type I vs Type II (both SOC 1 and SOC 2)

Both SOC 1 and SOC 2 have Type I and Type II versions.

### Type I
- Point-in-time assessment
- Tests design of controls only
- Faster to achieve
- Good first step for new companies

### Type II
- Period-of-time assessment (3-12 months)
- Tests design AND operating effectiveness
- Required by most enterprise customers
- More comprehensive assurance

## Can you need both SOC 1 and SOC 2?

Yes, some organizations need both.

Some companies need both SOC 1 and SOC 2 reports. For example, a payroll company that also offers HR software might need:
- **SOC 1** for their payroll processing services (affects client financial statements)
- **SOC 2** for their HR software platform (handles sensitive employee data)

If you're unsure which you need, talk to your customers. Their requirements will guide you.

## Common questions

Frequently asked questions about SOC 1 vs SOC 2

### Is SOC 2 harder to get than SOC 1?
Not necessarily. The difficulty depends on your existing controls. SOC 2 has more security-focused criteria, while SOC 1 focuses on financial controls. For most technology companies, SOC 2 is more relevant to their existing practices.

### Can SOC 2 replace SOC 1?
No. They serve different purposes. SOC 1 is specifically for controls relevant to financial reporting. If your clients' auditors require a SOC 1 report, a SOC 2 report won't satisfy that requirement.

### Which is more commonly requested?
SOC 2 is more commonly requested by technology buyers. Enterprise customers typically require SOC 2 during vendor security reviews. SOC 1 is primarily requested by companies with SOX compliance requirements.

## Compliance that actually improves your security

Most platforms give you a checklist. We give you a security posture you can prove - continuously, automatically, and in the open.

### Evidence that's never stale
Most platforms rely on manual screenshots and spreadsheets. By the time you collect evidence, something has already regressed. We pull evidence continuously from 500+ integrations - every config, every screenshot, every log - so your compliance posture reflects reality, not last quarter.

### Policies written for your business, not a template
Other platforms hand you generic policy documents and call it done. We generate every policy from the context you provide during onboarding - your stack, your processes, your risk tolerance. No two customers get the same boilerplate.

### A device agent that never sleeps
A checklist doesn't stop a misconfigured laptop at 2am. Our open-source device agent runs 24/7 on every employee machine - checking disk encryption, firewall status, screen lock, password length, and antivirus. Failures are flagged instantly, not discovered during the next audit cycle.

### Automated tests you can write yourself
Say "show me that SSL is active on my domain" and it generates an automated test that runs daily. Or give it browser instructions - "go to our GitHub repo, click settings, verify branch protection rules" - and AI opens a browser, verifies the control, and screenshots the result. Every evidence piece is auditable and logged.

### Trust portals that reflect reality
Most trust centers are static marketing pages. Ours is live-monitored - only published policies appear, and only verified controls are shown. The moment a policy is marked as draft or a control fails, it's removed automatically. What your customers see is what you actually have.

### Open source and verifiable
Most compliance platforms are black boxes - you trust them because you have to. We're fully open source. Every agent, every integration, every check is auditable on GitHub. You don't take our word for it, you verify it.