A SOC 2 Type II report provides an independent examination of a service provider's controls over a defined period. Review our report when vendor due diligence, purchasing and renewal reviews, customer commitments, or your own auditors call for evidence about the controls of an outsourced service.

Your policies or contracts may require a provider's report. The criteria and report scope determine which questions it can help answer. The AICPA's SOC resources explain the different examination types.

Files.com Examination and Scope

Files.com undergoes an annual independent SOC 2 Type II examination covering the Security, Availability, and Confidentiality Trust Services Criteria. The report evaluates the design and operating effectiveness of the controls in scope over the examination period.

Processing Integrity and Privacy are separate Trust Services Criteria and are not part of this examination. Their inclusion in the general description of SOC 2 below does not extend the Files.com report's scope.

The latest report expresses an unqualified opinion, with no exceptions noted for the controls tested. The opinions on control design and operating effectiveness depend on subservice organizations and customers applying the complementary controls assumed in the design. Review those controls in the report against your own deployment, alongside the Shared Responsibility Model.

A SOC 2 report is an examination of the described system and period. It does not certify every customer workflow or replace your decisions about access, retention, processing, and connected systems.

What Is SOC 2 Type II?

SOC 2 (System and Organization Controls 2) is an auditing standard developed by the American Institute of Certified Public Accountants (AICPA). Its Trust Services Criteria provide five possible categories for an examination:

Security: protection against unauthorized access, both physical and logical
Availability: system availability and uptime, relative to business commitments
Processing Integrity: accuracy and reliability of system processing
Confidentiality: protection of sensitive or restricted data
Privacy: collection, use, retention, and disposal of personal information

There are two types of SOC 2 reports. A Type I report validates that appropriate controls exist at a single point in time. A Type II report evaluates the operating effectiveness of those controls over time, typically a 3 to 12-month period.

SOC 2 Type II is the more rigorous of the two. It tells customers that security controls are in place and are consistently followed and monitored.

Files.com SOC 2 Audit History

Our most recent SOC 2 Type II audit was conducted by Kirkpatrick Price, an audit firm specializing in cloud and SaaS platforms.

Audit Period: April 1, 2025 – March 31, 2026
Final Report Issued: May 18, 2026
Next Audit Period Start Date: April 1, 2026
Next Anticipated Final Report: May 30, 2027

Files.com has completed multiple SOC 2 Type II audits with Kirkpatrick Price in previous years.

Accessing the Report

The latest report and management bridge letter are available through the Trust Center under NDA. Document Requests explains access requests and recovery of previously granted access. Use the bridge letter when your review also needs management's statement covering the period after the most recent examination.