Compliance Glossary

A SOC 3 report summarizes the controls a service organization has in place to protect the security, availability, processing integrity, confidentiality, and privacy of the services it provides. It’s based on the SSAE 18 standard and is similar to a SOC 2 report but doesn’t contain as much detail about the system and services. This is because the report’s users do not need that level of information.

SOC 2 reports, on the other hand, provide more detailed information and are intended for users who need to know more about the controls in place at the service organization.

SOC 3 reports are considered general-use reports and are often used as a marketing tool by the service organization and provided to prospective customers who do not need the level of detail in a SOC 2 report.