Updated SOC 2 Type II page

fern/docs.yml

@@ -1008,12 +1008,12 @@ navigation:
                 path: security-and-privacy/zero-data-retention.mdx
               - page: PCI compliance
                 path: security-and-privacy/PCI.mdx
+              - page: SOC 2 Type II compliance
+                path: security-and-privacy/soc.mdx
               - page: Proxy server guide
                 path: security-and-privacy/proxy-server.mdx
               - page: Static IP addresses
                 path: security-and-privacy/static-ip-addresses.mdx
-              - link: SOC-2 Compliance
-                href: https://security.vapi.ai/
           - section: Legal
             collapsed: true
             icon: fa-light fa-user-shield

fern/security-and-privacy/soc.mdx

@@ -1,6 +1,29 @@
 ---
-title: SOC-2 Compliance
+title: SOC 2 Type II Compliance
+subtitle: Learn how Vapi ensures SOC 2 Type II attestation for its voice agent platform
 slug: security-and-privacy/soc
-description: Vapi's SOC 2 compliance for its voice AI platform. Find the SOC 2 report and audited security controls in the Vapi security center.
+description: Vapi is SOC 2 Type II attested, covering security, availability, and confidentiality for all customers. Request the report from the Vapi Customer Trust Portal.
 ---
 
+Vapi, as a Voice Agent Platform, is a SOC 2 Type II-attested service organization and undergoes annual third-party audits to validate its compliance with the framework. SOC 2 (Service Organization Control 2) is an independent audit framework developed by the American Institute of Certified Public Accountants (AICPA) that evaluates how service providers manage and protect customer data.
+
+Vapi SOC 2 Type II attestation and compliance cover all customers using Vapi’s services, including both Pay-Go and Enterprise plans; therefore, every customer using Vapi’s platform is covered without any additional activation.
+
+## Type I vs. Type II
+
+- **SOC 2 Type I** evaluates whether security controls are properly designed at a specific point in time
+- **SOC 2 Type II** (Vapi’s attestation) evaluates whether those controls are not only properly designed but also operating effectively over an extended period (typically 12 months)
+
+Type II provides greater assurance because it demonstrates consistent, ongoing effectiveness of security controls rather than just their existence at a single moment.
+
+## Vapi’s SOC 2 Type II Coverage
+
+Our attestation report includes three main Trust Service Criteria:
+
+- **Security:** Protection against unauthorized access (logical and physical)
+- **Availability:** System accessibility for operation and use as committed
+- **Confidentiality:** Protection of confidential information as committed
+
+Every annual Vapi audit covers Vapi’s infrastructure, policies, procedures, and operational controls across our entire platform.
+
+Customers on any plan can request access to our SOC 2 Type II report and other security documentation through our Customer Trust Portal at [https://security.vapi.ai/](https://security.vapi.ai/).

fern/snippets/faq-snippet.mdx

@@ -67,11 +67,11 @@ Absolutely. Vapi is built to support high-volume workloads. Daily session volume
 
 Yes, we take compliance seriously. Vapi is:
 - HIPAA compliant for healthcare applications
-- SOC 2 Type II certified
+- SOC 2 Type II-attested
 - GDPR compliant for handling EU data
 - Regularly audited to maintain these certifications
 
-For detailed compliance documentation and reports, please visit our [security portal](https://security.vapi.ai/).
+For detailed compliance documentation and reports, please visit our [Customer Trust Portal](https://security.vapi.ai/).
 
   </Accordion>
   <Accordion title="How do you handle PII and PHI securely?" icon="lock" iconType="solid" defaultOpen={false}>