From f842d07c311353d556b0277f7a9d031bbd0d04ee Mon Sep 17 00:00:00 2001 From: Stephen Smith Date: Tue, 13 Oct 2026 11:41:52 -0700 Subject: [PATCH] Updated SOC 2 Type II page --- fern/docs.yml | 4 ++-- fern/security-and-privacy/soc.mdx | 27 +++++++++++++++++++++++++-- fern/snippets/faq-snippet.mdx | 4 ++-- 3 files changed, 29 insertions(+), 6 deletions(-) diff --git a/fern/docs.yml b/fern/docs.yml index cff559889..15d0f18c3 100644 --- a/fern/docs.yml +++ b/fern/docs.yml @@ -1008,12 +1008,12 @@ navigation: path: security-and-privacy/zero-data-retention.mdx - page: PCI compliance path: security-and-privacy/PCI.mdx + - page: SOC 2 Type II compliance + path: security-and-privacy/soc.mdx - page: Proxy server guide path: security-and-privacy/proxy-server.mdx - page: Static IP addresses path: security-and-privacy/static-ip-addresses.mdx - - link: SOC-2 Compliance - href: https://security.vapi.ai/ - section: Legal collapsed: true icon: fa-light fa-user-shield diff --git a/fern/security-and-privacy/soc.mdx b/fern/security-and-privacy/soc.mdx index 98f557770..9722cd6ba 100644 --- a/fern/security-and-privacy/soc.mdx +++ b/fern/security-and-privacy/soc.mdx @@ -1,6 +1,29 @@ --- -title: SOC-2 Compliance +title: SOC 2 Type II Compliance +subtitle: Learn how Vapi ensures SOC 2 Type II attestation for its voice agent platform slug: security-and-privacy/soc -description: Vapi's SOC 2 compliance for its voice AI platform. Find the SOC 2 report and audited security controls in the Vapi security center. +description: Vapi is SOC 2 Type II attested, covering security, availability, and confidentiality for all customers. Request the report from the Vapi Customer Trust Portal. --- +Vapi, as a Voice Agent Platform, is a SOC 2 Type II-attested service organization and undergoes annual third-party audits to validate its compliance with the framework. SOC 2 (Service Organization Control 2) is an independent audit framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates how service providers manage and protect customer data. + +Vapi SOC 2 Type II attestation and compliance cover all customers using Vapi’s services, including both Pay-Go and Enterprise plans; therefore, every customer using Vapi’s platform is covered without any additional activation. + +## Type I vs. Type II + +- **SOC 2 Type I** evaluates whether security controls are properly designed at a specific point in time +- **SOC 2 Type II** (Vapi’s attestation) evaluates whether those controls are not only properly designed but also operating effectively over an extended period (typically 12 months) + +Type II provides greater assurance because it demonstrates consistent, ongoing effectiveness of security controls rather than just their existence at a single moment. + +## Vapi’s SOC 2 Type II Coverage + +Our attestation report includes three main Trust Service Criteria: + +- **Security:** Protection against unauthorized access (logical and physical) +- **Availability:** System accessibility for operation and use as committed +- **Confidentiality:** Protection of confidential information as committed + +Every annual Vapi audit covers Vapi’s infrastructure, policies, procedures, and operational controls across our entire platform. + +Customers on any plan can request access to our SOC 2 Type II report and other security documentation through our Customer Trust Portal at [https://security.vapi.ai/](https://security.vapi.ai/). diff --git a/fern/snippets/faq-snippet.mdx b/fern/snippets/faq-snippet.mdx index 4a2d34d13..962e33fb7 100644 --- a/fern/snippets/faq-snippet.mdx +++ b/fern/snippets/faq-snippet.mdx @@ -67,11 +67,11 @@ Absolutely. Vapi is built to support high-volume workloads. Daily session volume Yes, we take compliance seriously. Vapi is: - HIPAA compliant for healthcare applications -- SOC 2 Type II certified +- SOC 2 Type II-attested - GDPR compliant for handling EU data - Regularly audited to maintain these certifications -For detailed compliance documentation and reports, please visit our [security portal](https://security.vapi.ai/). +For detailed compliance documentation and reports, please visit our [Customer Trust Portal](https://security.vapi.ai/).