---
title: "What SOC2 requirements should a VoIP platform vendor meet?"
topic: "Security & Compliance"
updated: 2026-07-09
canonical: https://acrobits.net/resources/knowledge-base/soc2-requirements-voip-platform-vendor/
summary: "A VoIP platform vendor should hold a current SOC 2 Type II report covering at least the Security criterion, and ideally Availability as well. Require Type II specifically: it proves the vendor's security and operational controls operated effectively over a sustained audit period (typically 6 to 12 months), whereas a Type I report only confirms controls existed at a single point in time. Because the report is an independent CPA attestation, ask for the current copy, confirm it covers the production systems that will handle your subscribers' traffic, and pair it with a signed Data Processing Agreement."
---

# What SOC2 requirements should a VoIP platform vendor meet?

> A VoIP platform vendor should hold a current SOC 2 Type II report covering at least the Security criterion, and ideally Availability as well. Require Type II specifically: it proves the vendor's security and operational controls operated effectively over a sustained audit period (typically 6 to 12 months), whereas a Type I report only confirms controls existed at a single point in time. Because the report is an independent CPA attestation, ask for the current copy, confirm it covers the production systems that will handle your subscribers' traffic, and pair it with a signed Data Processing Agreement.

A VoIP platform vendor should hold a current **[SOC 2 Type II report](/voip-glossary/soc-2-for-voip-vendors/)** covering at least the Security criterion, and ideally Availability as well. Require Type II specifically: it proves the vendor's security and operational controls operated effectively over a sustained audit period (typically 6 to 12 months), whereas a Type I report only confirms controls existed at a single point in time. Because the report is an independent CPA attestation, ask for the current copy, confirm it covers the production systems that will handle your subscribers' traffic, and pair it with a signed Data Processing Agreement.

## The five trust services criteria for VoIP

SOC 2 reports are scoped to one or more of five Trust Services Criteria (TSCs). Security is mandatory; the others are optional. For a VoIP platform vendor, operators should require coverage of at least:

  - **Security (CC)**: mandatory baseline. Covers logical access controls, encryption in transit and at rest, change management, incident response, and vendor risk management. For VoIP, verify this includes SIP signaling protection and credential handling.

  - **Availability (A)**: critical for real-time communications. Covers uptime commitments, network monitoring, disaster recovery, and business continuity. Ask for the audit period's SLA attainment and documented failover procedures.

  - **Confidentiality (C)**: relevant where the vendor stores call records, voicemails, or subscriber PII. Verify encryption at rest and data retention terms.

  - **Privacy (P)**: if the vendor's platform processes subscriber personal data (names, phone numbers, location for E.911), Privacy criteria ensure GDPR- and CCPA-aligned controls. This matters especially for healthcare and other regulated deployments.

  - **Processing Integrity (PI)**: lower priority for voice-only deployments; more relevant if the vendor processes billing data or routing decisions on your behalf.

## What to ask a VoIP platform vendor

  - **Report type and date**: Is it Type II? When does the audit period end? A report older than 12 months is usually treated as stale in procurement reviews. Request a bridge letter if the current audit is in progress.

  - **Scope**: Which systems are in scope? The report must cover the infrastructure that will process your subscribers' traffic (e.g., push notification infrastructure, SIP proxy, provisioning portal). Confirm the scope statement explicitly includes the services you are licensing.

  - **Trust Criteria covered**: Security is the minimum baseline. For a VoIP platform, require at least Security and Availability.

  - **Sub-processor list**: Which third-party cloud providers, CDNs, or push notification gateways (e.g., APNs, FCM) does the vendor rely on? Are those sub-processors themselves SOC 2 audited? Request the full sub-processor list and confirm a change-notification commitment.

  - **Exceptions and qualifications**: Read the auditor's opinion. A qualified or adverse opinion is a red flag. Note any exceptions (controls that failed during the audit period) and ask how they were remediated.

  - **Pen test recency**: A SOC 2 report is not a penetration test. Request a summary of the most recent third-party pen test (ideally within 12 months) and any critical findings.

  - **Incident history**: Ask for a summary of material security incidents during the last audit period and how they were handled. This is often in the system description section of the report.

  - **Data Processing Agreement (DPA)**: Confirm the vendor will sign a DPA that defines processing purpose, data categories, breach notification timelines (72 hours is standard for GDPR), retention/deletion terms, and audit rights.

## Required SOC 2 items and maturity signals

**Required SOC 2 items for enterprise operators.**

  - SOC 2 Type II report with Security criteria, current within 12 months, covering the production environment

  - Willingness to share the report under NDA

  - A signed DPA

  - Documented incident response and change management processes

**Additional SOC 2 signals of maturity.**

  - Availability and Confidentiality criteria included

  - Annual pen testing by a named third party

  - ISO 27001 certification alongside SOC 2

  - Continuous compliance monitoring (not just point-in-time)

  - Sub-processor list published or promptly disclosed

  - HIPAA Business Associate Agreement (BAA) available for healthcare deployments

Cloud Softphone by Acrobits supports [HIPAA-](/resources/knowledge-base/is-there-a-hipaa-compliant-voip-app-for-healthcare/) and GDPR-compliant configurations. To confirm the current SOC 2 audit status, request the security documentation package or contact [sales@cloudsoftphone.com](mailto:sales@cloudsoftphone.com).

{
  "@context": "https://schema.org",
  "@type": "FAQPage",
  "mainEntity": [
    {
      "@type": "Question",
      "name": "What SOC2 requirements should a VoIP platform vendor meet?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A VoIP platform vendor should hold a current SOC 2 Type II report covering at least the Security criterion, and ideally Availability as well. Require Type II specifically: it proves the vendor's security and operational controls operated effectively over a sustained audit period (typically 6 to 12 months), whereas a Type I report only confirms controls existed at a single point in time. Because the report is an independent CPA attestation, ask for the current copy, confirm it covers the production systems that will handle your subscribers' traffic, and pair it with a signed Data Processing Agreement."
      }
    },
    {
      "@type": "Question",
      "name": "What is the difference between SOC 2 Type I and Type II for a VoIP vendor?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "A SOC 2 Type I report tests that security controls existed at a single point in time. A Type II report tests that those controls operated effectively over an audit period, typically 6–12 months. For vendor procurement, require Type II: Type I is considered transitional and does not prove ongoing operational discipline."
      }
    },
    {
      "@type": "Question",
      "name": "Which SOC 2 Trust Services Criteria should a VoIP platform vendor cover?",
      "acceptedAnswer": {
        "@type": "Answer",
        "text": "At minimum: Security (mandatory in every SOC 2 audit) and Availability (critical for real-time voice services). If the vendor stores call records or subscriber PII, also require Confidentiality. For regulated verticals such as healthcare, request Privacy criteria coverage and a HIPAA BAA."
      }
    }
  ]
}