What is a SOC 2 report?
Short answer
A SOC 2 report is an independent auditor's report on a vendor's security controls, and optionally availability, confidentiality and privacy. It is not a certification.
What it is
SOC 2 reports follow the AICPA's Trust Services Criteria. A Type I report describes the controls in place on one date; a Type II report tests whether they operated over a period, usually six to twelve months. Vendors share them under a non-disclosure agreement, and the useful parts are the auditor's opinion, the exceptions noted, and the list of controls.
A vendor saying it is "SOC 2 compliant" or "aligned" without a report has not been audited. Only the report itself proves anything.
Why it matters for a tax firm
The FTC Safeguards Rule requires a firm to assess and oversee its service providers. Reading a vendor's SOC 2 Type II report, or noting that it does not have one, is the standard way to document that step.
How XyloDocs handles it
XyloDocs describes its controls on its Security page and does not claim a SOC 2 report it does not hold. Firms doing vendor review can ask for the current security documentation.
Related terms
Read more on XyloDocs
Sources
Questions about SOC 2
Is SOC 2 required for tax software vendors?
No law requires it. The Safeguards Rule requires the firm to oversee its vendors, and a SOC 2 report is the common evidence.
What is the difference between Type I and Type II?
Type I says the controls existed on a date. Type II says an auditor tested them over months and reports what failed. Ask for Type II.
Last reviewed: October 16, 2026. This glossary explains terms; it is not legal or tax advice. Check the cited source for the current rule.
Stop chasing documents and status calls
XyloDocs is the AI client communication platform for tax firms: bilingual calls and texts, document intake over WhatsApp and email, and status updates clients read before they phone.