Guides
What SOC 2 requires, how to evaluate AI voice platform security controls, and what enterprise procurement teams should look for before approving deployment.
Last updated
If your team is deploying AI voiceAI voiceAn AI voice is synthetic speech produced by a text-to-speech model, using a selected or cloned voice to speak an agent's generated or scripted response. agents to call, text, and email inbound leads, your security team will eventually ask one question: "Is your voice platform SOC 2 compliant?" It usually comes up during vendor review, after the demo but before procurement signs off. For revenue teams in insurance, mortgage, healthcare, financial services, and other regulated consumer industries, SOC 2 is often the difference between a platform that passes security review and one that stalls in procurement for months.
This guide breaks down what SOC 2 requires, why it matters specifically for AI voice and messaging platforms, and how to evaluate whether a vendor's security posture will hold up under enterprise scrutiny.
SOC 2 is not a legal mandate. It is a voluntary attestation framework developed by the AICPA (American Institute of Certified Public Accountants). But in practice, enterprise procurement teams treat it as a baseline requirement. If you cannot produce a SOC 2 report, your vendor onboarding slows down or stops.
SOC 2 audits are conducted against the AICPA's Trust Services Criteria (TSC), last revised in the 2017 TSC document with updated Points of Focus released in 2022. The framework evaluates how a service organization safeguards customer data across five categories. Security is the only required category; the rest are optional but commonly included.
| TSC Category | What it evaluates | Why it matters for AI voice platforms |
|---|---|---|
| Security (Common Criteria) | Access controls, network protection, vulnerability management, incident response | Voice platforms process call recordings, transcripts, PII, and CRM data — all requiring protection against unauthorized access |
| Availability | System uptime, disaster recovery, capacity monitoring | Lead conversion depends on agents being available when leads come in; downtime means missed revenue |
| Processing Integrity | Data processing accuracy and completeness | Call outcomes, disposition tags, and CRM write-back must be accurate — errors corrupt downstream pipeline |
| Confidentiality | Restricted data handling, encryption, data classification | Call transcripts and recordings contain sensitive customer information that must not leak |
| Privacy | Personal data collection, retention, deletion, and disclosure | Platforms handling PII from leads must define retention windows and honor deletion requests |
The Security category (also called the Common Criteria) is mandatory in every SOC 2 examination. It includes controls across nine domains: control environment, communication and information, risk assessment, monitoring activities, control activities, logical and physical access controls, system operations, change management, and risk mitigation. These map to the 17 COSO principles adopted by the AICPA.
SOC 2 reports come in two types:
If a vendor says they are "SOC 2 compliant" but only has a Type I report, that is a weaker claim. Enterprise security teams will usually ask for Type II.
When evaluating an AI voice platform for enterprise deployment, use this checklist to assess whether their SOC 2 posture covers the controls that matter for voice, SMS, and CRM-integrated workflows.
| Control area | What to verify | Why it matters |
|---|---|---|
| Data encryption | AES-256 at rest, TLS 1.2+ in transit for all voice, SMS, and API traffic | Call recordings and transcripts contain PII; encryption prevents exposure if infrastructure is compromised |
| Access controls | Role-based access (RBAC), SSO/SAML, MFA, least-privilege defaults, audit logs | Limits which team members can access recordings, transcripts, and customer CRM data |
| Call recording storage | Encrypted storage, defined retention period, access logging for playback | Recordings are the most sensitive data type; unrestricted access is a common audit finding |
| Sub-processor management | Documented sub-processor list, advance notification of changes, due diligence process | Voice platforms use telecom carriers (Twilio, Telnyx), LLM providers, and TTS engines — each is a data processor |
| Incident response | Documented IR plan, defined severity levels, breach notification timeline | If a data breach occurs, you need to know how and when the vendor will tell you |
| Change management | Controlled deployment process, separation of duties, rollback procedures | Agent script changes, prompt updates, and workflow modifications should follow a review process |
| Vulnerability management | Regular scanning, penetration testing, remediation SLAs | Voice platforms expose phone numbers, webhooks, and APIs — all attack surfaces |
| Data retention and deletion | Defined retention windows, documented deletion process, customer-initiated deletion | PII from leads should not live indefinitely; GDPR and state privacy laws require deletion on request |
| Audit logging | Immutable logs of administrative actions, data access, and system changes | If something goes wrong, you need to trace who did what and when |
| Vendor due diligence | SOC 2 report covers the vendor's own vendors (sub-processors) | Your data flows through multiple layers; a SOC 2 gap at any layer is your risk |
Thoughtly holds SOC 2 Type II, HIPAAHIPAAHIPAA is a US federal law whose Privacy, Security, and Breach Notification Rules govern protected health information for covered entities and business associates., and GDPR certifications. For teams evaluating an AI voice platform for regulated consumer lead conversion, here is how Thoughtly's security posture maps to the controls that enterprise security teams typically scrutinize.
OAuth-based integrations, not credential sharing. Every CRM integrationCRM integrationA CRM integration connects an agent or communications platform with a CRM so the systems can exchange records, events, and actions. Thoughtly ships — Salesforce, HubSpot, Pipedrive, Zoho, and the rest — uses native OAuthOAuthOAuth is an authorization framework that lets an application receive limited access to another service without collecting the user’s password.. No credentials are shared with the AI agent. This means access can be revoked, scoped, and audited at the integration level, which aligns with SOC 2 access control requirements.
Consent and compliance controls built into the agent layer. Thoughtly's Start nodes and Speak nodes support verbatim compliance lines — meaning you can require the agent to state a consent or disclosure message exactly as written before the conversation continues. This matters for TCPATCPAThe TCPA is a US federal law governing certain calls and text messages, including restrictions tied to technology, consent, revocation, identification, and do-not-call protections., state recording-consent laws, and AI disclosure requirements. The platform also handles opt-outOpt-outAn opt-out is a person’s request to stop receiving a particular category of calls, texts, emails, or other communications. keywords (STOP, UNSUBSCRIBE, HELP) across SMS channels and propagates them to your CRMCRMA CRM is the system used to manage leads, contacts, accounts, opportunities, activity, ownership, and follow-up..
TCPA-safe dialing, consent tracking, and DNC honoring. The platform includes built-in TCPA-safe dialing controls, consent tracking, and do-not-call list honoring. These are operational compliance features that complement SOC 2's security controls — they reduce the risk of regulatory violations that could triggerTriggerA trigger is an event or condition that starts, resumes, changes, or stops an automated workflow. breach notification obligations.
Vulnerability reporting and sub-processor transparency. Thoughtly maintains a security bulletin and accepts vulnerability reports at [email protected] with a 24-hour response SLASLAAn SLA, or service level agreement, defines the response or resolution commitment for a lead, request, handoff, or operational queue.. The sub-processor list is available on request, with 30-day advance notification of material changes.
SOC 2 is a foundation, not a ceiling. It does not replace HIPAA, PCI-DSS, or industry-specific regulatory requirements. But it provides a validated baseline that the platform's security controls are designed and operating effectively — which is what enterprise procurement teams need to see before they approve deployment.
No. SOC 2 is a voluntary framework, not a legal mandate. However, enterprise procurement teams commonly require it as a precondition for vendor approval. If you cannot produce a SOC 2 report, you may face delayed onboarding or be excluded from consideration entirely.
Type I evaluates whether controls are suitably designed at a single point in time. Type II evaluates whether controls are designed AND operating effectively over a period of 6–12 months. Type II is the stronger attestation and the one enterprise security teams typically require.
No. SOC 2 and HIPAA address different requirements. SOC 2 is an audit of security and operational controls based on AICPA Trust Services Criteria. HIPAA is a federal law with specific requirements for protected health information (PHIPHIPHI, or protected health information, is individually identifiable health information held or transmitted by a HIPAA covered entity or business associate.). A vendor can hold both, but one does not imply the other. Thoughtly holds both SOC 2 Type II and HIPAA certifications.
SOC 2 Type II reports typically cover a 12-month observation period. Most vendors re-audit annually. If the report is more than 15 months old, request a bridge letter or confirmation that controls have not materially changed since the report date.
Yes, but the SOC 2 report should cover sub-processor management. The platform vendor is responsible for conducting due diligence on its sub-processors (including LLMLarge Language Model (LLM)A large language model (LLM) is a machine-learning model trained on large text collections to interpret and generate language from prompts and context. providers like OpenAI, Anthropic, or Google) and including them in its risk assessment. Verify that the vendor's sub-processor list is current and that you receive advance notification of changes.
AICPA, "System and Organization Controls: SOC Suite of Services" — https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services
AICPA, "2017 Trust Services Criteria with Revised Points of Focus (2022)" (TSP Section 100) — https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
Linford & Company, "Trust Services Criteria (TSCs) for SOC 2 Reports" — https://linfordco.com/blog/trust-services-critieria-principles-soc-2/
Thoughtly Security Page — https://thoughtly.com/company/security
Thoughtly, "Voice AI and Data Security: How to Protect Your Customer's Information" — https://thoughtly.com/blog/voice-ai-and-data-security-how-to-protect-your-customers-information
Thoughtly, "TCPA and AI Outbound Calling: A Practical Compliance Checklist" — https://thoughtly.com/blog/tcpa-ai-outbound-calling-compliance-checklist
Thoughtly, "HIPAA Considerations for AI Voice and SMS in Healthcare" — https://thoughtly.com/blog/hipaa-considerations-ai-voice-sms-healthcare
