---
title: "SOC 2 Compliance — Definition & Engineering Context"
description: "System and Organization Controls (SOC) 2 is a voluntary compliance standard for service organizations, developed by the AICPA, specifying how companies must manage customer data based on five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy."
canonical: https://erpstack.io/glossary/soc2
markdown_url: https://erpstack.io/glossary/soc2.md
publisher: ERPStack
---

# SOC 2 Compliance

> **Definition:** System and Organization Controls (SOC) 2 is a voluntary compliance standard for service organizations, developed by the AICPA, specifying how companies must manage customer data based on five Trust Services Criteria: security, availability, processing integrity, confidentiality, and privacy.

## In depth

SOC 2 compliance is a critical security certification for B2B B2B software platforms. A SOC 2 audit evaluates an organization's system controls and procedures against the Trust Services Criteria: Security, Availability, Confidentiality, Processing Integrity, and Privacy. Achieving SOC 2 compliance requires building security into your application architecture and deployment pipelines. This requires implementing automated auditing for all database changes, strict role-based access controls (RBAC) to limit data access, and secure secrets management.

## How ERPStack applies this

We build all our custom ERP and SaaS systems with SOC 2 compliance in mind. This includes built-in role-based access control (RBAC), end-to-end database encryption, secure environment variable handling (via Env.ts), and automated audit logs.

## Related reading

- [HIPAA Compliance](https://erpstack.io/glossary/hipaa)
- [Technical Debt](https://erpstack.io/glossary/tech-debt)