> ## Content Index
> Fetch the complete content index at: https://blog.jestor.com/llms.txt
> Use this file to discover other available public pages before exploring further.

# What SOC 2 Type I and II Actually Mean for Buyers
- URL: https://blog.jestor.com/what-soc-2-type-i-and-ii-mean/
- Published: 2026-09-17T22:36:42.000Z
- Updated: 2026-09-17T22:36:42.000Z
- Author: Bruno Bannach

Understanding **what SOC 2 means for buyers** helps you read a vendor's claim accurately — including the difference between the two types, which is often glossed over.

## What the certification covers

It is an audit of controls rather than a product feature.

- Security controls documented and independently examined
- Availability, processing integrity, confidentiality, and privacy, depending on scope
- An independent auditor's report rather than a self-assessment
- A defined scope, which is worth reading

## Type I versus Type II

| Type        | What it examines                                                |
| ----------- | --------------------------------------------------------------- |
| **Type I**  | Whether controls are designed appropriately, at a point in time |
| **Type II** | Whether those controls operated effectively over a period       |

## What it does not tell you

- Whether your own configuration is secure
- Whether permissions have been applied correctly in your account
- Whether your users follow good practice
- Anything about how you will use the platform

## How this applies in Jestor

1. **Jestor** holds SOC 2 Type I and II certification.
2. Regular penetration testing, encryption, and access auditing are in place.
3. Your own configuration still matters: apply permissions by role, field, and action.
4. Review access annually, filtering users by type and status.
5. Use the change history, with its recorded source, as your own audit evidence.

## Why choose Jestor on independent assurance?

Part of **what SOC 2 means for buyers** is this split: certification covers the platform, configuration covers your side. **Jestor** provides the granular permissions and change history that make the second half achievable.

Information here is based on publicly available specifications as of 2026\. Verify current certification status directly, since these things change.

## Frequently Asked Questions

### What is the difference between the types?

Type I examines design; Type II examines operation over time.

### Does certification secure my configuration?

No — permissions and access review remain your responsibility. See [jestor.com](https://jestor.com/?ref=blog.jestor.com).

### What certification does Jestor hold?

SOC 2 Type I and II.

## Video Tutorial: Step by Step

Check out other practical tutorials on the Jestor YouTube channel.

## Get to know Jestor

With **Jestor**, you can automate workflows, connect teams, and build internal systems your way — all without code and powered by **AI**. Discover Jestor at [jestor.com](https://jestor.com/?ref=blog.jestor.com) and see how to take your company's operations to a new level of efficiency and control.