A Type I report describes the design of controls at a point in time. A Type II report also tests whether the controls operated effectively over a period, usually several months.
Vendors usually share the report under a non-disclosure agreement. Ask for the latest Type II report and check its period and scope, including which subcontractors are carved out.
"SOC 2 in progress" means the audit has not been completed.
As of November 11, 2026. General information, not legal advice.