SOC 2 Type 2 Compliant
What SOC 2 Type 2 Means for Your Data
Unlike a point-in-time assessment, Type 2 evaluates operating effectiveness over an extended period.
Most vendors will tell you their security is strong. Very few can show you evidence that an independent auditor examined whether that was true.
That's the difference SOC 2 Type 2 describes, and it's worth understanding before you evaluate any partner who handles your data.
Type 1 shows design. Type 2 shows proof
A SOC 2 Type 1 report
Examines whether an organization's security controls are designed appropriately as of a single date. It's a snapshot. On the day of the assessment, the controls existed and were structured correctly.
A SOC 2 Type 2 report
Examines whether those controls actually operated, correctly and consistently, across a sustained observation period. The auditor pulls evidence from the entire window: access logs, change records, incident tickets, onboarding and offboarding documentation. The question shifts from whether the controls were designed well to whether the organization actually ran them.
What this means for you in practice
-
Your security questionnaire gets a faster answer. Published documentation covers most of what procurement and security teams ask, so review cycles compress from weeks to days.
-
The controls run continuously. Monitoring is ongoing rather than assembled ahead of an audit date. That's the operational meaning of a Type 2 observation period.
-
Incident response is a tested procedure. We commit to notifying affected clients within 72 hours of confirming a security incident, and that commitment sits inside a documented, audited response process.
-
Every subprocessor is disclosed. You can see the complete list of third parties that process data on our behalf, updated as it changes.
How this governs our use of AI
AI providers are subprocessors.
Evaluated and monitored under the same vendor management controls as every other third party, and published on the same list.
Client data is excluded from provider model training by configuration.
Using enterprise agreements rather than default consumer settings.
Human review is a control, not a courtesy.
A Techfino consultant reviews every deliverable before it reaches you, and our professional warranty applies to AI-assisted work exactly as it does to any other work.
Data retention and destruction policies apply uniformly.
Regardless of which tools were involved in producing the work.
Requesting the report
Our SOC 2 Type 2 report is available to clients and prospective clients under NDA. Request access through the trust.techfino.com, where you'll also find our policy library, control inventory, subprocessor list, and security FAQ.