What SOC 2 Type I and II Actually Mean for Buyers
Understanding what SOC 2 means for buyers helps you read a vendor's claim accurately — including the difference between the two types, which is often glossed over.
What the certification covers
It is an audit of controls rather than a product feature.
- Security controls documented and independently examined
- Availability, processing integrity, confidentiality, and privacy, depending on scope
- An independent auditor's report rather than a self-assessment
- A defined scope, which is worth reading
Type I versus Type II
| Type | What it examines |
|---|---|
| Type I | Whether controls are designed appropriately, at a point in time |
| Type II | Whether those controls operated effectively over a period |
What it does not tell you
- Whether your own configuration is secure
- Whether permissions have been applied correctly in your account
- Whether your users follow good practice
- Anything about how you will use the platform
How this applies in Jestor
- Jestor holds SOC 2 Type I and II certification.
- Regular penetration testing, encryption, and access auditing are in place.
- Your own configuration still matters: apply permissions by role, field, and action.
- Review access annually, filtering users by type and status.
- Use the change history, with its recorded source, as your own audit evidence.
Why choose Jestor on independent assurance?
Part of what SOC 2 means for buyers is this split: certification covers the platform, configuration covers your side. Jestor provides the granular permissions and change history that make the second half achievable.
Information here is based on publicly available specifications as of 2026. Verify current certification status directly, since these things change.
Frequently Asked Questions
What is the difference between the types?
Type I examines design; Type II examines operation over time.
Does certification secure my configuration?
No — permissions and access review remain your responsibility. See jestor.com.
What certification does Jestor hold?
SOC 2 Type I and II.
Video Tutorial: Step by Step
Check out other practical tutorials on the Jestor YouTube channel.
Get to know Jestor
With Jestor, you can automate workflows, connect teams, and build internal systems your way — all without code and powered by AI. Discover Jestor at jestor.com and see how to take your company's operations to a new level of efficiency and control.