Guides
What SOC 2 requires, how to evaluate AI voice platform security controls, and what enterprise procurement teams should look for before approving deployment.
Last updated
If your team is deploying AI voiceAI voiceAn artificially generated, natural-sounding voice produced by a TTS model. Thoughtly supports a library of AI voices and brand-specific cloning. agents to call, text, and email inbound leads, your security team will eventually ask one question: "Is your voice platform SOC 2 compliant?" It usually comes up during vendor review, after the demo but before procurement signs off. For revenue teams in insurance, mortgage, healthcare, financial services, and other regulated consumer industries, SOC 2 is often the difference between a platform that passes security review and one that stalls in procurement for months.
This guide breaks down what SOC 2 requires, why it matters specifically for AI voice and messaging platforms, and how to evaluate whether a vendor's security posture will hold up under enterprise scrutiny.
SOC 2 is not a legal mandate. It is a voluntary attestation framework developed by the AICPA (American Institute of Certified Public Accountants). But in practice, enterprise procurement teams treat it as a baseline requirement. If you cannot produce a SOC 2 report, your vendor onboarding slows down or stops.
SOC 2 audits are conducted against the AICPA's Trust Services Criteria (TSC), last revised in the 2017 TSC document with updated Points of Focus released in 2022. The framework evaluates how a service organization safeguards customer data across five categories. Security is the only required category; the rest are optional but commonly included.
| TSC Category | What it evaluates | Why it matters for AI voice platforms |
|---|---|---|
| Security (Common Criteria) | Access controls, network protection, vulnerability management, incident response | Voice platforms process call recordings, transcripts, PII, and CRM data — all requiring protection against unauthorized access |
| Availability | System uptime, disaster recovery, capacity monitoring | Lead conversion depends on agents being available when leads come in; downtime means missed revenue |
| Processing Integrity | Data processing accuracy and completeness | Call outcomes, disposition tags, and CRM write-back must be accurate — errors corrupt downstream pipeline |
| Confidentiality | Restricted data handling, encryption, data classification | Call transcripts and recordings contain sensitive customer information that must not leak |
| Privacy | Personal data collection, retention, deletion, and disclosure | Platforms handling PII from leads must define retention windows and honor deletion requests |
The Security category (also called the Common Criteria) is mandatory in every SOC 2 examination. It includes controls across nine domains: control environment, communication and information, risk assessment, monitoring activities, control activities, logical and physical access controls, system operations, change management, and risk mitigation. These map to the 17 COSO principles adopted by the AICPA.
SOC 2 reports come in two types:
If a vendor says they are "SOC 2 compliant" but only has a Type I report, that is a weaker claim. Enterprise security teams will usually ask for Type II.
When evaluating an AI voice platform for enterprise deployment, use this checklist to assess whether their SOC 2 posture covers the controls that matter for voice, SMS, and CRM-integrated workflows.
| Control area | What to verify | Why it matters |
|---|---|---|
| Data encryption | AES-256 at rest, TLS 1.2+ in transit for all voice, SMS, and API traffic | Call recordings and transcripts contain PII; encryption prevents exposure if infrastructure is compromised |
| Access controls | Role-based access (RBAC), SSO/SAML, MFA, least-privilege defaults, audit logs | Limits which team members can access recordings, transcripts, and customer CRM data |
| Call recording storage | Encrypted storage, defined retention period, access logging for playback | Recordings are the most sensitive data type; unrestricted access is a common audit finding |
| Sub-processor management | Documented sub-processor list, advance notification of changes, due diligence process | Voice platforms use telecom carriers (Twilio, Telnyx), LLM providers, and TTS engines — each is a data processor |
| Incident response | Documented IR plan, defined severity levels, breach notification timeline | If a data breach occurs, you need to know how and when the vendor will tell you |
| Change management | Controlled deployment process, separation of duties, rollback procedures | Agent script changes, prompt updates, and workflow modifications should follow a review process |
| Vulnerability management | Regular scanning, penetration testing, remediation SLAs | Voice platforms expose phone numbers, webhooks, and APIs — all attack surfaces |
| Data retention and deletion | Defined retention windows, documented deletion process, customer-initiated deletion | PII from leads should not live indefinitely; GDPR and state privacy laws require deletion on request |
| Audit logging | Immutable logs of administrative actions, data access, and system changes | If something goes wrong, you need to trace who did what and when |
| Vendor due diligence | SOC 2 report covers the vendor's own vendors (sub-processors) | Your data flows through multiple layers; a SOC 2 gap at any layer is your risk |
Thoughtly holds SOC 2 Type II, HIPAAHIPAAThe US health privacy law that governs protected health information. Healthcare voice and SMS workflows must handle PHI with appropriate safeguards., and GDPR certifications. For teams evaluating an AI voice platform for regulated consumer lead conversion, here is how Thoughtly's security posture maps to the controls that enterprise security teams typically scrutinize.
OAuth-based integrations, not credential sharing. Every CRMCRMThe system of record for leads, contacts, deals, and activity. Thoughtly reads from and writes to your CRM continuously. integration Thoughtly ships — Salesforce, HubSpot, Pipedrive, Zoho, and the rest — uses native OAuthOAuthAn authentication standard that lets Thoughtly connect to your CRM or app without storing your password.. No credentials are shared with the AI agent. This means access can be revoked, scoped, and audited at the integration level, which aligns with SOC 2 access control requirements.
Consent and compliance controls built into the agent layer. Thoughtly's Start nodes and Speak nodes support verbatim compliance lines — meaning you can require the agent to state a consent or disclosure message exactly as written before the conversation continues. This matters for TCPATCPAUS federal law governing telemarketing calls and SMS. Thoughtly enforces consent capture, time-of-day windows, and DNC scrubbing automatically., state recording-consent laws, and AI disclosure requirements. The platform also handles opt-outOpt-outA recipient’s request to stop receiving calls or messages. Compliant systems must capture opt-outs and suppress future outreach where required. keywords (STOP, UNSUBSCRIBE, HELP) across SMS channels and propagates them to your CRM.
TCPA-safe dialing, consent tracking, and DNC honoring. The platform includes built-in TCPA-safe dialing controls, consent tracking, and do-not-call list honoring. These are operational compliance features that complement SOC 2's security controls — they reduce the risk of regulatory violations that could triggerTriggerThe event or condition that starts an automated workflow, such as a new lead, missed call, CRM status change, calendar booking, or completed call. breach notification obligations.
Vulnerability reporting and sub-processor transparency. Thoughtly maintains a security bulletin and accepts vulnerability reports at [email protected] with a 24-hour response SLA. The sub-processor list is available on request, with 30-day advance notification of material changes.
SOC 2 is a foundation, not a ceiling. It does not replace HIPAA, PCI-DSS, or industry-specific regulatory requirements. But it provides a validated baseline that the platform's security controls are designed and operating effectively — which is what enterprise procurement teams need to see before they approve deployment.
No. SOC 2 is a voluntary framework, not a legal mandate. However, enterprise procurement teams commonly require it as a precondition for vendor approval. If you cannot produce a SOC 2 report, you may face delayed onboarding or be excluded from consideration entirely.
Type I evaluates whether controls are suitably designed at a single point in time. Type II evaluates whether controls are designed AND operating effectively over a period of 6–12 months. Type II is the stronger attestation and the one enterprise security teams typically require.
No. SOC 2 and HIPAA address different requirements. SOC 2 is an audit of security and operational controls based on AICPA Trust Services Criteria. HIPAA is a federal law with specific requirements for protected health information (PHI). A vendor can hold both, but one does not imply the other. Thoughtly holds both SOC 2 Type II and HIPAA certifications.
SOC 2 Type II reports typically cover a 12-month observation period. Most vendors re-audit annually. If the report is more than 15 months old, request a bridge letter or confirmation that controls have not materially changed since the report date.
Yes, but the SOC 2 report should cover sub-processor management. The platform vendor is responsible for conducting due diligence on its sub-processors (including LLMLarge Language Model (LLM)A machine-learning model trained on massive text data, used as the reasoning engine that drives a voice agent's understanding and responses. providers like OpenAI, Anthropic, or Google) and including them in its risk assessment. Verify that the vendor's sub-processor list is current and that you receive advance notification of changes.
AICPA, "System and Organization Controls: SOC Suite of Services" — https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
AICPA, "2017 Trust Services Criteria with Revised Points of Focus (2022)" (TSP Section 100) — https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
Linford & Company, "Trust Services Criteria (TSCs) for SOC 2 Reports" — https://linfordco.com/blog/trust-services-critieria-principles-soc-2/
Thoughtly Security Page — https://thoughtly.com/company/security
Thoughtly, "Voice AI and Data Security: How to Protect Your Customer's Information" — https://thoughtly.com/blog/voice-ai-and-data-security-how-to-protect-your-customers-information
Thoughtly, "TCPA and AI Outbound Calling: A Practical Compliance Checklist" — https://thoughtly.com/blog/tcpa-ai-outbound-calling-compliance-checklist
Thoughtly, "HIPAA Considerations for AI Voice and SMS in Healthcare" — https://thoughtly.com/blog/hipaa-considerations-ai-voice-sms-healthcare
