What it means
The American Institute of Certified Public Accountants defines the SOC 2 framework, which covers five trust services criteria: security, availability, processing integrity, confidentiality and privacy. A Type 1 report describes whether the controls are designed appropriately at one point in time. A Type 2 report tests whether those controls operated effectively over a period, which is why Type 2 carries more weight with buyers. SOC 2 is an attestation, not a certification, though vendors and reviewers often call it one. It differs from ISO 27001, which is a certification against an international standard.
Why it matters when you buy software
A SOC 2 Type 2 report gives a buyer independent evidence of how a vendor runs its security controls, and many procurement and security reviews ask for it. Check which services the report covers, the period it spans and whether the vendor shares it openly or only under a non-disclosure agreement. A vendor stating that it holds SOC 2 is a vendor-sourced claim until the report itself is read.
Where it appears in the reviews
The security and compliance score on every review rests partly on published certifications. Password manager reviews such as 1Password, Bitwarden and Dashlane report vendor-stated SOC 2 Type 2 coverage, and the Jira review reports that Atlassian publishes SOC 2 Type II. See how the criterion is scored in the methodology.
See also: Single sign-on, Zero knowledge encryption and the best password managers.