Security questions from your first large customer, and when you need SOC 2

A large customer often checks a supplier before it signs. Its security team may want evidence that your company will protect its data, in the form of a questionnaire, a report from a CPA firm, or a certificate. This page explains each one from the bodies that publish them, then covers the questions that are specific to an AI product. It is part of the guide on building your AI product after you raise.

What a SOC 2 report is

SOC stands for System and Organization Controls. The AICPA, the professional body of US certified public accountants (CPAs), describes SOC as "a suite of service offerings CPAs may provide in connection with system-level controls of a service organization or entity-level controls of other organizations" [1]. A service organization is a company that provides a service to other companies, such as a software product. Controls are the rules and checks a company uses to protect its systems, such as who can access data and how changes are approved.

A SOC 2 report is the result of an examination by a CPA firm. The AICPA's guide describes it as "an examination of controls at a service organization relevant to security, availability, processing integrity, confidentiality, or privacy" [2]. It explains why customers ask for it: "customers and business partners usually need information about the design, operation, and effectiveness of controls within the service organization's system", and "To support their information needs, customers and business partners often request a SOC 2 report from the service organization" [2].

The five areas in that list come from the Trust Services Criteria, which the AICPA describes as "control criteria established by the AICPA's Assurance Services Executive Committee (ASEC)" for evaluating "controls over the security, availability, processing integrity, confidentiality, or privacy of information and systems used to provide products or services" [3]. A criterion is a standard that each control is judged against.

The AICPA's SOC 2 guide was updated on October 15, 2022, and the AICPA says it "Has been fully updated to reflect new requirements and guidance of SSAE No. 20 and SSAE No. 21" [2]. SSAE is the name of a series of AICPA standards that auditors follow in these examinations. The AICPA also publishes an illustrative report for a "SOC 2 type 2 examination" and notes that similar changes "may also need to be made to SOC 2 type 1 or other SOC reports" [4]. So there are two types of SOC 2 report. This guide does not define them, because the AICPA's definitions are in its SOC 2 guide, a paid publication. Ask the customer which type it accepts, and read the AICPA's guide or ask a CPA firm, before you choose.

Choose the firm that prepares the report with care

The firms that sell SOC services include compliance vendors as well as the CPA firms that perform the examination. The AICPA's SOC page carries a notice: "The AICPA is looking into allegations published anonymously about the business practices of a compliance vendor that offers Systems and Organization Control (SOC) services" [1]. It adds: "we continue to emphasize that SOC services should be thoroughly evaluated by service organizations and CPA firms" [1]. The AICPA does not name the vendor. Before you hire anyone for SOC 2 work, find out which CPA firm will sign the report and check that firm.

ISO/IEC 27001

Some customers ask for ISO/IEC 27001 instead of SOC 2 or alongside it. ISO describes ISO/IEC 27001 as "the world's best-known standard for information security management systems (ISMS)", which is ISO's own claim about its standard, and says "It defines requirements an ISMS must meet" [5]. An information security management system is the set of policies, processes and people a company uses to manage information security. ISO says the standard "preserves the confidentiality, integrity and availability of information by applying a risk management process" [5].

Certification is optional. ISO says "companies implementing ISO/IEC 27001 can decide whether they want to go through a certification process", and that "Holding a certificate from an accredited conformity assessment body may bring an additional layer of confidence" [5]. An accredited conformity assessment body is a certification firm that has itself been checked and approved to issue certificates. ISO reports that, per the ISO Survey 2022, "over 70 000 certificates were reported in 150 countries" [5]. It also asks companies to state the version: "certified to ISO/IEC 27001:2022" and not just "certified to ISO 27001" [5]. ISO lists one amendment to the current version, ISO/IEC 27001:2022/Amd 1:2024 [5].

The Cloud Security Alliance questionnaire

A customer may send its own questionnaire or a published one. The Cloud Security Alliance (CSA), an industry group, publishes the Consensus Assessments Initiative Questionnaire (CAIQ). Version 4.1 was released on January 27, 2026 [6]. CSA says: "It provides a set of Yes/No questions a cloud consumer and cloud auditor may wish to ask of a cloud provider to ascertain their compliance to the Cloud Controls Matrix (CCM)" [6]. The Cloud Controls Matrix is CSA's list of security controls for cloud services. CSA describes the CAIQ as "an industry-accepted way to document what security controls exist in IaaS, PaaS, and SaaS services" [6]. SaaS, software as a service, is software sold as an online subscription, which describes an AI product sold online. A company can also submit its completed CAIQ to CSA's STAR Registry [6].

Filling in the CAIQ once, honestly, gives you a written set of answers to reuse when a customer sends its own form.

Document	Who produces it	What it is	Source
SOC 2 report	A CPA firm	An examination of controls for security, availability, processing integrity, confidentiality or privacy	AICPA [2]
ISO/IEC 27001 certificate	A certification body	Certification that the company's information security management system meets the standard	ISO [5]
CAIQ v4.1	The company itself	Yes or no answers on security controls, mapped to the Cloud Controls Matrix	Cloud Security Alliance [6]

The questions that depend on your model provider

An AI product sends customer data to a model provider, so the customer's security team may ask what that provider does with it. Your answer depends on your provider's terms. Here are the figures from each provider's own pages, read on 26 October 2026.

Customer's question	OpenAI	Anthropic	Google (Gemini API)
How long does the provider keep our data?	Abuse monitoring logs up to 30 days by default [7]	Inputs and outputs deleted within 30 days, with listed exceptions [8]	55 days for abuse monitoring [9]
Can retention be turned off?	Zero data retention needs OpenAI's prior approval [7]	Separate agreements such as zero data retention are listed as exceptions [8]	Not covered in the pages read
Is our data used to train models?	Not as of March 1, 2023, unless you opt in [7]	Commercial terms forbid training on customer content [11]	Free use: yes, to improve products; paid use: no [12]

The page choosing a model provider: terms and data use has the full detail and the sources for every cell. Keep a one-page summary of your provider, model, tier and terms, dated, with your security documents. Update it each time you change model or provider.

Other questions are specific to AI. Prepare answers on which model the product uses, where the model runs, whether customer data is used to improve the product, how prompts and outputs are logged in your own systems, and how the product is tested before each release. A written eval suite, the set of repeatable tests of the product's answers, is the evidence for the last one. The guide on why AI evals matter explains it.

Open-source software

Open-source code is also checked in due diligence. Lawyers at Morgan Lewis, writing in June 2026 about due diligence for a company sale, say "Buyers frequently assess whether a company maintains a written OSS policy governing the use of OSS" and that diligence typically "requires a scan of the company's software" [10]. OSS is open-source software. Write the policy and run the scan once, and you have an answer ready if a customer asks about open-source code as well.

When a startup needs SOC 2

No source opened for this guide sets a stage or a revenue level at which a startup needs a SOC 2 report. The AICPA's statement that customers often request one [2] is the practical answer: you need it when your customers ask for it.

Reveneau's view is that a seed-stage company should answer its first security questionnaire honestly, with the controls it has, and start the SOC 2 work when a customer contract depends on the report. Before that day, put these controls in place:

1. Two-step login, a password plus a code from a phone or a key, for every system the team uses.
2. Access to customer data limited to named people, with a written record of who has it.
3. Every change to the code reviewed and tested before release, with the record kept.
4. A written plan for what happens when there is a security incident.
5. A list of suppliers, including the model provider, with their terms.
6. Backups that have been restored once to prove they work.

For a finance product, the guide on SOC 2 for a financial software engineering process goes further.

Where Reveneau fits

Reveneau is an AI software development consultancy with offices in San Francisco and Vancouver. Reveneau says AI writes all of its code and every change must pass an eval suite written from the specification. It says it takes responsibility for the whole project through production and after release. To plan the security controls with the product, see AI development at Reveneau or contact Reveneau.