A vendor’s security claims should lead to evidence you can evaluate. A blog title, a feature list, or a signed activity record is not a substitute for an independent assurance report. This article does not announce a completed Truthlocks SOC 2 examination.
Ask for the report and its scope
SOC 2 reporting addresses controls relevant to the applicable Trust Services Criteria. A Type II report considers the operation of controls over a period, rather than only their design at a point in time. The AICPA’s SOC resources explain the reporting framework.
During a vendor review, request the current report where available. Check the service covered, observation period, opinion, exceptions, and responsibilities expected of customers. Do not assume that a report for one service covers every product or deployment from the same organization.
Distinguish three kinds of evidence
- Vendor assurance: independent material about the service and controls within its assessed scope.
- Your configured workflow: evidence that your organization assigned access, reviewed exceptions, and operated the process it intended.
- A signed record: evidence connecting particular information or a reported action to its signing source.
These layers support different questions. A valid action receipt can help establish which service reported an event. It does not prove that a control operated effectively across an entire organization or observation period.
Review the workflow you will actually use
For an invoice process, identify who can submit evidence, who can review it, and who can authorize a consequential action. Inspect the actual permissions and exception paths. Ask how records are retained, how evidence is exported, and what happens when a connected service is unavailable.
The governance tools and compliance workflows can support evidence organization. Configuration and connected sources determine what a workflow captures. Your reviewers still assess whether that evidence is sufficient.
Get current information
Use the security page and contact form to discuss current assurance material and your requirements. For a concrete operational example, review audit submission records. Evaluate the actual evidence and agreement rather than treating marketing language as a certification.