What is a SOC 2 report and does a dealership software vendor need one?

Type I and Type II are not interchangeable

Type I says controls were designed appropriately on a date. Type II says they operated effectively across a period, usually six to twelve months. Ask which one you are being shown and what period it covers.

Read the exceptions and the scope

The value is in the detail, not the logo. Check which systems are in scope, which trust criteria are included, and what exceptions the auditor recorded. A report scoped to a product you are not buying tells you nothing.

Absence is not disqualifying

Smaller and newer providers often have real controls and no report, because an audit is expensive. Where there is no SOC 2, ask for a completed security questionnaire, penetration-test summary, subprocessor list and incident-response commitment, and put the answers in the contract.

Re-check it

A report expires. Make annual re-provision a contractual obligation rather than something you have to chase.

How to read a report in practice

Begin with the auditor's opinion and the description of the system, then the list of controls tested and any exceptions. Check the period covered and whether it ends recently.

Look for carve-outs, where the vendor relies on another company's controls, such as a hosting provider. Ask the vendor to explain each exception and what was done about it.

A short conversation with the security contact usually tells you more than the cover page.

What to ask when there is no report

Ask for a completed security questionnaire, a summary of the latest independent penetration test, the list of subprocessors, the incident-response and notification commitments and details on staff background checks and training. Ask about a plan to obtain an independent report, and set a date. A smaller vendor that answers openly and specifically can be a reasonable choice for a limited scope.

Common mistakes with assurance reports

Accepting a logo instead of a report is the first. Filing a report and never reading the exceptions is the second.

A third is ignoring the complementary controls the customer must operate, which the report lists; a dealer that skips them may not receive the protection described. Finally, track the report's expiry and request the next one when it is due.