SOC 2 (Service Organization Control 2)
An auditing standard that verifies a company's security, availability, and confidentiality controls.
SOC 2 (Service Organization Control 2) is an auditing framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates a service organization's controls related to security, availability, processing integrity, confidentiality, and privacy, the five Trust Service Criteria (TSC).
SOC 2 Type I vs. Type II
- SOC 2 Type I: Evaluates whether appropriate controls are in place at a specific point in time. Easier and faster to obtain, but less rigorous.
- SOC 2 Type II: Evaluates whether those controls are operating effectively over a sustained period (typically 6-12 months). Considered the gold standard for enterprise compliance.
Why SOC 2 matters for AI voice agents
AI voice agents process sensitive information, customer names, phone numbers, health details, payment information, and conversation content. Many enterprise buyers ask about SOC 2 as part of vendor due diligence before trusting a platform with this data.
A SOC 2 Type II report is intended to demonstrate:
- Data is protected by documented, tested security controls
- Access to customer data is logged and audited
- The platform maintains high availability
- Incidents are detected and responded to within defined SLAs
How TurboCall approaches security
TurboCall protects call data with AES-256 encryption at rest, TLS 1.2+ in transit, isolated per-tenant storage, and full access audit logging, and supports GDPR data processing agreements with EU data residency on request. See the Security & Trust Center for the current control set, or contact [email protected] for a security review.