SOC 2 An auditor’s report on a vendor’s controls: how to read one, and what it leaves out.
Short answer. SOC 2 is an attestation report, defined by the American Institute of CPAs (AICPA), in which a CPA firm examines a service organisation’s description of its system and its controls relevant to security, availability, processing integrity, confidentiality or privacy, against AICPA’s trust services criteria. A Type 1 report covers whether controls are suitably designed and in place on a given date; a Type 2 report also tests whether they operated effectively over a period. It is not a certificate or a pass mark: the report contains the auditor’s opinion, any exceptions found, and the controls the customer must run itself. Vendors commission them to show their customers; Microsoft, for example, has Office 365 examined for SOC 2 Type 2 every year. For an AI box inside your office, many of the controls that matter are run by your own staff.
01
Type 1 and Type 2
Point
Type 1
Type 2
Question answered
Are controls suitably designed and in place on a date?
Did they also operate effectively over a period?
Looks back over time
No
Yes, over the period of performance
Example
Microsoft runs mid-year Type 1 examinations for services added since the last Type 2
Microsoft examines Office 365 over a 12-month period, October to September
What else is inside
The system description and the auditor’s opinion
Also the tests performed, exceptions found and management’s responses
02
How to read one
Check the scope: which services, locations and trust services criteria are covered.
Check the period: a report for a period that ended a year ago says little about this quarter, so ask about bridge letters, which are the vendor’s own statements, not the auditor’s.
Read the exceptions and management’s responses, usually near the end of the report.
Find the user entity responsibilities: the controls you must operate yourself, such as reviewing who has access.
Check who signed it: the CPA firm’s experience and independence. AICPA’s Journal of Accountancy warned in February 2026 that promises of fast, cheap SOC 2 reports can come at the cost of quality.
03
What SOC 2 does not tell you
A SOC 2 report is about the vendor’s controls, not your own data protection duties. It does not say whether the vendor stores data in India, whether prompts are used for training, or whether the service suits your sector’s rules. The Journal of Accountancy notes that compliance is “a term never used in SOC 2 examinations”, so “SOC 2 compliant” in marketing should prompt a request for the report itself.
04
On-premise AI and SOC 2
When AI runs on a device in your office, many controls a SOC 2 report would test, such as who can reach the data and how logs are kept, are operated by your own staff. What still matters is what the vendor can reach. ANVE has no certifications and no SOC 2 report; it is pre-release. As its /security page sets out, ANVE does not update itself over the internet: today ANVEAI installs updates on site, and signed update packages applied offline by USB are not on ANVE yet.
05
Questions people ask
Is SOC 2 a certification?
No. It is an attestation report in which a CPA firm gives an opinion on controls. There is no SOC 2 certificate.
Does SOC 2 have legal status in India?
No. It is a US attestation framework, but it can be a contract requirement between businesses anywhere.
What is a bridge letter?
A vendor’s own statement covering the gap between the end of the last examined period and today. Microsoft notes its bridge letters are self-attestations, not reports based on an auditor’s examination.
Should we ask an on-premise AI vendor for SOC 2?
Ask first what the vendor can reach remotely, how updates are delivered and who can access your box for support. Controls inside your office are yours to run.
06
What is not real yet
No sealed ANVE unit exists; every image of the appliance on this site is a labelled render. The software runs today on a development machine. No customers yet, no certifications, no delivery date, and the final price is not announced.
Reservations are ₹999 in India or US$12 elsewhere, refundable in full until you confirm an order in writing (terms). Offices that cannot use cloud AI can apply to be one of ten design partners.
