SOC 2 · Evaluation guide

SOC 2 readiness for a self-managed customer data platform (CDP)

This customer data platform (CDP) guide helps security teams prepare a SOC 2 evaluation for customer-managed infrastructure. Define the system scope and evidence; a product architecture is not an auditor report.

Scope your deployment review Review deployment ownership →

Readiness guidance · Verify report scope and examination period before relying on an attestation

Evidence boundary

What this page establishes

AICPA Trust Services Criteria cover security, availability, processing integrity, confidentiality and privacy. A SOC 2 report concerns an examination of a defined service organization's system and controls; a product architecture description is not that report.

No PrivyCDP auditor report is presented on this page. Before relying on a vendor attestation, obtain the report, confirm the covered service and period, review exceptions, and identify the controls your organization must operate. Your auditor determines the appropriate scope and evidence.

Planning your evaluation

A practical evidence checklist

These are proposed review tests, not claims that every control is enabled or independently verified in every PrivyCDP deployment.

Security: prove who can access the deployment

Collect the access matrix, privileged-account inventory, approval records, access-review results and a sample of operator logs. Include vendor support access and service accounts in the boundary.

Availability: demonstrate recovery

Define the recovery time and recovery point objectives. Test a restore using the proposed topology; retain the test record, backup retention policy and escalation ownership.

Confidentiality: follow the keys and data

Map key custody, rotation, secrets handling, exports and destination permissions. Verify permissions in the deployed configuration, including backup copies and support tooling.

Processing integrity: reconcile a complete workflow

Run synthetic events through ingestion, identity matching and activation. Retain the reconciliation results, duplicate-handling behavior and evidence for failed or retried events.

Privacy: demonstrate the operating process

Assign responsibility for retention, consent and subject requests. Test a withdrawal or deletion across the profile store, downstream systems and applicable backup retention process.

Planning your evaluation

From requirements to an accepted control boundary

Use synthetic data during evaluation and make acceptance evidence part of the deployment plan.

Before a pilot

List the customer, vendor, hosting provider and integration partners. Record which party administers infrastructure, keys, application permissions, monitoring and support. Include external processors rather than assuming self-hosting removes them.

Before production

Agree which control evidence will be delivered, who reviews it and how often it is refreshed. Resolve missing controls or tests before approval, and preserve the accepted configuration and operating runbook.

Discuss your deployment with engineers.

Bring your data flow, operating owners and evaluation questions.

Start deployment qualification Review Enterprise TCO Model →Request permissioned references and release-specific evidence during evaluation.

Frequently asked questions

Is SOC 2 a software certification?

SOC 2 concerns an examination of a defined service organization system and controls. A product description is not an examination report. Primary source

Does PrivyCDP publish a SOC 2 Type II report?

No auditor report is presented on this site. Ask for the report, system scope, period, exceptions and customer responsibilities before relying on an attestation. Primary source

What changes when we operate the platform ourselves?

Your team must assign infrastructure, access, monitoring, backup and incident owners. Document vendor and hosting responsibilities too. Primary source

Which evidence should an evaluation collect?

Collect access reviews, change approvals, restore tests, incident procedures and workflow reconciliation appropriate to the proposed system scope. Primary source

Does a successful pilot prove audit readiness?

A pilot establishes only the tested behavior. Examination scope, operating period and evidence requirements must be determined with your auditor. Primary source

Can deployment controls support our SOC 2 evaluation?

They can provide evidence to assess. Verify the implemented configuration and operating process rather than treating a framework label as approval. Primary source