Cadmium SOC2 report - latest version 2025

What is a SOC 2 Report?

A SOC 2 (System and Organization Controls 2) report is an audit report developed by the American Institute of CPAs (AICPA). It serves as a recognized standard for evaluating how a service organization securely manages and protects customer data.

Essentially, it acts as a "proof of security" that businesses use to assure clients that their sensitive information is safe from unauthorized access or breaches.

The Five Trust Services Criteria

A SOC 2 audit evaluates an organization's internal controls against five core pillars, known as the Trust Services Criteria:

• Security: The system is protected against unauthorized physical and logical access. (This is the only mandatory criterion for every SOC 2 report).
• Availability: The system is available for operation and use as agreed upon by a contract or service level agreement (SLA).
• Processing Integrity: System processing is complete, valid, accurate, timely, and authorized.
• Confidentiality: Information designated as confidential is protected as agreed or committed.
• Privacy: Personal information is collected, used, retained, disclosed, and disposed of securely.

Why Does it Matter?

For B2B service providers, SaaS companies, and cloud computing vendors, a SOC 2 report is often a baseline requirement to do business. It builds trust, streamlines the sales process, and demonstrates a serious commitment to data security and regulatory compliance.