SOC 2
SOC 2, from first check to final report
Viglyn runs continuous checks against your stack, collects evidence that proves its own integrity, and hosts the Type 1 or Type 2 examination itself.
What it is
SOC 2 is an attestation developed by the AICPA that reports on how a service organization protects customer data against the Trust Services Criteria. A Type 1 report assesses how your controls are designed at a point in time; a Type 2 report assesses how they operate over a period.
Who it's for
B2B SaaS and technology companies that handle customer data. It's the report enterprise buyers in North America ask for most during vendor due diligence.
With Viglyn
How Viglyn runs SOC 2
- Automated checks run across your cloud, identity, device, code, and HR systems on demand, daily, or hourly
- Evidence is the actual system response, hashed for integrity, so nothing rests on screenshots
- The examination runs inside Viglyn: structured evidence requests, auditor access you control, threaded comments, exportable workpapers with integrity hashes
- The same evidence maps to ISO 27001 and any other framework you add, with no cap on frameworks
FAQ
SOC 2 questions
Should we do Type 1 or Type 2?
Type 1 shows your controls are designed well at a point in time; Type 2 shows they operate over a period. Many buyers ask for Type 2. Viglyn supports both, and continuous monitoring keeps evidence accumulating through your Type 2 window.
Who performs the audit?
An independent, licensed CPA firm issues the report; the opinion is theirs alone. Viglyn is where the work happens: evidence requests, scoped auditor access, comments, and exportable workpapers.
Does the evidence stay current between audits?
Yes. Checks run on demand, daily, or hourly, and your compliance score, severity breakdown, and trend stay current year-round.
See SOC 2 run on your stack
A 30-minute walkthrough with your systems and your framework. No commitment.