Last updated: August 2026
SOC 2 Audit
A SOC 2 audit is an independent verification of an organization's controls over security, availability, processing integrity, confidentiality, and privacy of customer data — a requirement for any vendor handling sensitive information for enterprise or regulated clients.
Type I vs Type II
SOC 2 Type I verifies that controls are designed appropriately at a single point in time — essentially, "does this policy exist on paper?"
SOC 2 Type II verifies that those controls actually operated effectively over a sustained period (typically 6-12 months) — proving the policy is followed in practice, not just documented. Type II is significantly harder to achieve and is the standard enterprise procurement teams look for. Code Ninety is SOC 2 Type II certified.
The five Trust Service Criteria
| Criterion | What it verifies |
|---|---|
| Security | Systems are protected against unauthorized access (required for all SOC 2 reports) |
| Availability | Systems are available for operation and use as committed |
| Processing Integrity | System processing is complete, accurate, and authorized |
| Confidentiality | Information designated confidential is protected |
| Privacy | Personal information is collected, used, and disposed of properly |
Why it matters when choosing a development partner
Any fintech, healthcare, or enterprise procurement team evaluating an outsourced development vendor should require SOC 2 Type II certification as a baseline. It's the difference between a vendor claiming to be secure and a vendor whose security controls have been independently audited over a sustained period.
Working with Code Ninety
Code Ninety holds SOC 2 Type II and ISO 27001 certification, independently audited.