# Evaluating verification infrastructure: questions about SOC 2 and evidence

> Separate a vendor’s assurance report from your own operational evidence, and ask concrete questions about scope, controls, and access.

By Security Team
Published: 2026-02-20
Updated: 2026-10-03T05:03:32.142377Z
Canonical page: https://www.truthlocks.com/blog/soc-2-type-ii-certification

A vendor’s security claims should lead to evidence you can evaluate. A blog title, a feature list, or a signed activity record is not a substitute for an independent assurance report. This article does not announce a completed Truthlocks SOC 2 examination.

## Ask for the report and its scope

SOC 2 reporting addresses controls relevant to the applicable Trust Services Criteria. A Type II report considers the operation of controls over a period, rather than only their design at a point in time. The [AICPA’s SOC resources](https://www.aicpa-cima.com/resources/landing/system-and-organization-controls-soc-suite-of-services) explain the reporting framework.

During a vendor review, request the current report where available. Check the service covered, observation period, opinion, exceptions, and responsibilities expected of customers. Do not assume that a report for one service covers every product or deployment from the same organization.

## Distinguish three kinds of evidence

- **Vendor assurance:** independent material about the service and controls within its assessed scope.
- **Your configured workflow:** evidence that your organization assigned access, reviewed exceptions, and operated the process it intended.
- **A signed record:** evidence connecting particular information or a reported action to its signing source.

These layers support different questions. A valid action receipt can help establish which service reported an event. It does not prove that a control operated effectively across an entire organization or observation period.

## Review the workflow you will actually use

For an invoice process, identify who can submit evidence, who can review it, and who can authorize a consequential action. Inspect the actual permissions and exception paths. Ask how records are retained, how evidence is exported, and what happens when a connected service is unavailable.

The [governance tools](https://www.truthlocks.com/product/governance) and [compliance workflows](https://www.truthlocks.com/product/compliance-autopilot) can support evidence organization. Configuration and connected sources determine what a workflow captures. Your reviewers still assess whether that evidence is sufficient.

## Get current information

Use the [security page](https://www.truthlocks.com/security) and [contact form](https://www.truthlocks.com/contact) to discuss current assurance material and your requirements. For a concrete operational example, review [audit submission records](https://www.truthlocks.com/industries/accounting#audit-submissions). Evaluate the actual evidence and agreement rather than treating marketing language as a certification.