SOC 2: Type 1 & Type 2
A SOC 2 report is independent proof that you protect the data your customers trust you with and that the controls are designed properly and actually doing their job, day in and day out.
If you're a SaaS, cloud, or tech business handling customer data, sooner or later a serious buyer will ask you to prove it. A SOC 2 report answers that for you, examined independently against recognised Trust Services Criteria and issued through our CPA partner. We offer both Type 1 (are the right controls in place today?) and Type 2 (have they worked consistently over a period of time?). It's the difference between "trust us" and here's the evidence.
What is SOC 2?
SOC 2 (System and Organisation Controls 2) is the recognised way to prove you protect the data your customers trust you with. Developed by the American Institute of CPAs, it's the assurance report enterprise buyers ask for, especially from SaaS, cloud, data platforms, tech companies and B2B software providers handling customer information on someone else's behalf.
SOC 2 is an independent report, rather than a certificate. An assessor examines your controls against the AICPA's Trust Services Criteria: Security (always included), plus Availability, Processing Integrity, Confidentiality, and Privacy as they apply and then writes up what they tested and how it held up. Because it's examined evidence rather than a self-declared badge, it's the kind of proof buyers and their security teams actually trust. We scope it to what's relevant to you and issue it through our licensed CPA partner.
SOC 2 comes in two types, and the difference is really just timing:
Type 1 is a snapshot, it confirms your controls are properly designed and in place at a single point in time. It's faster to achieve, and a strong first step.
Type 2 is the full picture, it confirms those controls actually operated effectively over a period, usually three to twelve months. It's more demanding, and the one most serious buyers want.
Most businesses start with Type 1, then move to Type 2 for a full operating period.
Why Get soc2?
A SOC 2 report is more than a box to tick, it's how you prove to your customers, and the security teams who vet you on their behalf, that you protect their data like it matters.
Win the deals you're missing - For a growing number of enterprise buyers, "send us your SOC 2" is a condition of doing business, not a nice-to-have. A report gets you through security reviews and procurement faster, and stops deals stalling before they start.
Proof, not promises - A SOC 2 report isn't a self-assessment or a badge you award yourself. It's your controls, examined independently and written up in black and white. It's the kind of evidence buyers, their security teams, and partners actually trust.
Real risk reduction - Getting ready for SOC 2 (and staying ready) means testing whether your controls actually work, not just whether they exist. That surfaces the weak spots early before they turn into an incident, a breach, or an awkward conversation with a client.
A stronger security culture - SOC 2 gives every control a clear owner and a routine. Security stops being something the IT team worries about and becomes part of how the whole organisation operates, day in and day out.
Credibility that opens doors - A current SOC 2 report signals maturity. It tells bigger customers, partners, and investors that you take security seriously and can back it up. This is a real advantage as data protection becomes the price of entry, not the exception.
EVERY AUDIT WE RUN IS
DESIGNED TO DO THREE THINGS.
GOOD FOR YOUR TEAM.
Practical improvements. Human-to-human conversations. Flexible, remote-first, and built around how and your team actually work.
Good ASSESSORS
People who are passionate about improving your business and genuinely invested in your growth, year after year.
Good for the world
Every audit funds health, community, and
environmental impact through our Good Fund. We're a B Corp and a 1% for the Planet member. This isn't a side project; it's embedded into everything we do.
THIS IS WHAT CERTIFICATION LOOKS LIKE WHEN IT GIVES A DAMN.
WELCOME TO BEING CERTIFIED WITH IMPACT™.
Six reasons we're
your partner
Trusted where it matters
Your SOC 2 report is examined against the AICPA's Trust Services Criteria and issued through our licensed CPA partner - the independent assurance enterprise buyers, security teams, and procurement reviewers already know to ask for.
Collaborative by design
We look for what's working first. Where there's a gap, we work with your team to close it through practical recommendations in plain language, not a control-by-control finding list.
Flexible audits, built around yoU
Fieldwork is largely remote and scheduled around your team, with evidence shared through your existing tools wherever possible. We adapt to you, not the other way around.
Consultant, DIY & platform-friendly
We play well with others. GRC platforms, internal consultants or your own internal setup - we fit seamlessly into your existing setup and keep things moving.
You’ll know us by name
From first enquiry to final report, you'll have a dedicated point of contact at every stage. Our leadership team is hands-on; a member of our senior team attends every opening or closing meeting personally to say g’day. Call us, WhatsApp us, email us. Our door is always open.
People who are invested in your growth
We only work with assessors who are genuinely passionate about improving your business and invested in your business, year after year.
From G'day to
getting started.
Let's have a chat
Book a discovery call with José, our CEO. This is really an opportunity to say G’day, have a conversation to understand your business, and see if we're the right fit.
We'll send you a quote within THE DAY
We're upfront about our pricing. Transparent pricing based on your team size and business complexity, with no hidden fees or surprises. And as a B Corp, we never want price to be a barrier so if you receive a more competitive quote from another provider, let us know and we'll do our best to match it.
We get started
Once you sign your fee proposal, our team will call you to welcome you to A Good Certification Group and walk you through the plan - tentative dates, your assessor, and everything you need to know before we kick off.
What our clients say
Certification Oceania were fantastic with our Surveillance audit! A Pleasure to work with, I couldn't recommend them more highly to anyone looking for a certification partner.
I had a great experience working with Good Certification Group/Certification Oceania to achieve our ISO 14001 and ISO 45001, and maintain our ISO 9001 certifications. Their team was professional, knowledgeable, and easy to work with throughout the entire process.They provided clear guidance and practical support, making what can be a complex process feel smooth and well-managed.
We recently completed our ISO 9001 certification with Certification Oceania and had a genuinely positive experience throughout the process. A special mention to our auditor, Niko Tovia, who was exceptional. His approach was not just about compliance, but about helping us truly understand our systems.
Certification Oceania have been so professionally flexible, and able to adjust their auditing arrangements to suit our busy business ramp up. The process of audits is well explained in advance, and they are very genuine in finding and explaining tangible gaps within a Quality Management System that actually drive an improvement your business will grow from.
Jose, and all the team at Certification Oceania, are supportive and customer focused. Actevate will always recommend this company for their dedication to their clients and for making the certification process feel achievable and a lot less daunting.
How it works
FAQs
Is SOC 2 a certification?
Not quite - SOC 2 results in an independent report, not a certificate or a pass/fail badge. An assessor examines your controls against the AICPA's Trust Services Criteria and documents what they tested and how it held up. It's more detailed than a certificate, which is exactly why the buyers asking for it trust it. You'll often hear people say "SOC 2 certified" as shorthand but what you actually receive is a report.
Should I get Type 1 or Type 2?
Type 1 confirms your controls are properly designed at a single point in time. It's faster, and a good move if a deal is waiting on it. Type 2 confirms those controls actually operated effectively over a period (usually three to twelve months), and it's the one most serious buyers really want. Many businesses start with Type 1 and move to Type 2 to cover a full period.
We already have ISO 27001, do we still need SOC 2?
Often, yes as they're different tools for different audiences. ISO 27001 certifies that you have an information security management system; SOC 2 gives a customer (usually North American, usually enterprise) a detailed report they can examine themselves. The good news is the controls overlap heavily, so if you're already strong on ISO 27001 you're well on your way, and much of that evidence carries across.
Do you issue the report yourselves?
A SOC 2 report has to be issued by a licensed CPA firm, so we deliver it through our CPA partner, while we guide you through the whole engagement the way we always do!
Get Certified with impactTM
.svg){kind=logo}
