Ad Tech Compliance
SOC 2 for ad tech platforms: Type 1 vs Type 2, what auditors test, and how to read the report
Published · Last updated
Next scheduled review:
SOC 2 for ad tech is an independent CPA firm's report on a platform's controls, measured against the AICPA Trust Services Criteria. It is an attestation, not a certificate. A Type 2 report tests how controls worked over a period; a Type 1 report checks their design at one date (Google Cloud, SOC 2).
Buyers of DSPs, SSPs, data platforms and clean rooms ask for SOC 2 in security reviews because the report shows what was tested and what failed (AICPA, SOC suite). This page explains the criteria, the report types and the reading order, then lists ad tech vendors that state SOC 2 publicly, with dates.
Contents
Key facts
- The criteria date from 2017. The current Trust Services Criteria cover security, availability, processing integrity, confidentiality and privacy, with points of focus revised in 2022 (AICPA, 2017 TSC).
- New criteria are proposed. The AICPA's Assurance Services Executive Committee issued exposure drafts of proposed 2027 SOC 2 criteria on 26 October 2026 (AICPA, exposure drafts).
- Quality concerns are on record. In May 2026 the AICPA told peer reviewers to look for SOC 2 engagements with "identical reports, risk assessments, sample sizes, and testing procedures" (Journal of Accountancy, 14 May 2026).
- FedRAMP now builds on it. FedRAMP's Class A certification is designed for commercial products "that already have a SOC 2 Type II certification" and a mature security programme (FedRAMP, classes).
- Regulators can require it. The FTC's proposed consent order on Publicis's acquisition of LiveRamp, accepted on 19 October 2026, requires independent SOC 2 audits, as reported (PPC Land, 2 November 2026).
Definition
SOC 2 is an examination in which an independent CPA firm reports on whether a service organisation's controls meet the AICPA Trust Services Criteria. The criteria cover five categories: security, availability, processing integrity, confidentiality and privacy (AICPA, 2017 TSC).
The AICPA sets the standards and the criteria. It does not issue reports, and it does not approve vendors. "SOC 2 certified" is common vendor language, but the output is an auditor's report addressed to the vendor and shared with its customers.
SOC 1, SOC 2 and SOC 3: which report answers which question
3 of 3 rows
SOC 1 | Are controls relevant to customers' financial reporting designed and working? | Customers' finance teams and their auditors | AWS publishes SOC 1 quarterly (AWS SOC FAQ) |
SOC 2 | Do controls meet the Trust Services Criteria chosen for the report? | Customers with a business need | AWS SOC 2 covers security, availability, confidentiality and privacy (AWS SOC FAQ) |
SOC 3 | A short public version of the SOC 2 opinion | Anyone | AWS posts its SOC 3 publicly (AWS SOC FAQ) |
SOC 1
- Question it answers
Are controls relevant to customers' financial reporting designed and working?
- Who usually gets it
Customers' finance teams and their auditors
- Example
AWS publishes SOC 1 quarterly (AWS SOC FAQ)
SOC 2
- Question it answers
Do controls meet the Trust Services Criteria chosen for the report?
- Who usually gets it
Customers with a business need
- Example
AWS SOC 2 covers security, availability, confidentiality and privacy (AWS SOC FAQ)
SOC 3
- Question it answers
A short public version of the SOC 2 opinion
- Who usually gets it
Anyone
- Example
AWS posts its SOC 3 publicly (AWS SOC FAQ)
Table by AdSovereign, CC BY 4.0.
SOC 1 matters more in ad tech than its name suggests. A DSP or SSP calculates media costs, fees and payouts, which feed its customers' accounts. The Trade Desk announced SOC 1 and SOC 2 Type 2 reports together on 11 January 2023 (The Trade Desk).
The Trust Services Criteria applied to ad tech
The vendor chooses which categories go into its report. Security is the base of every SOC 2 we cite here; the others vary. The table maps each category to controls an auditor would sample in four kinds of ad platform. The mapping is our analysis of how the criteria apply, not AICPA text.
5 of 5 rows
Security | Access to bidding configs and API keys; change management for models | Access to floor rules and partner endpoints | Role-based access to audience tables | Who can run queries; approval of new query templates |
Availability | Capacity and failover for peak bid traffic | Timeout handling and redundancy | Backup and restore of audience data | Uptime of the query environment |
Processing integrity | Auction logic, spend caps and fee calculation | Auction rules, deal priority, payout accuracy | Matching and deduplication logic | Aggregation thresholds applied before results leave |
Confidentiality | Separation of each advertiser's first-party data | Separation of buyer and seller data | Tenant isolation | No row-level data leaves the room |
Privacy | Use of consent signals in targeting | Passing consent strings to buyers | Notice, consent and deletion requests | Purpose limits on each collaboration |
Security
- Bidder (DSP)
Access to bidding configs and API keys; change management for models
- SSP or exchange
Access to floor rules and partner endpoints
- Data platform (CDP, DMP)
Role-based access to audience tables
- Clean room
Who can run queries; approval of new query templates
Availability
- Bidder (DSP)
Capacity and failover for peak bid traffic
- SSP or exchange
Timeout handling and redundancy
- Data platform (CDP, DMP)
Backup and restore of audience data
- Clean room
Uptime of the query environment
Processing integrity
- Bidder (DSP)
Auction logic, spend caps and fee calculation
- SSP or exchange
Auction rules, deal priority, payout accuracy
- Data platform (CDP, DMP)
Matching and deduplication logic
- Clean room
Aggregation thresholds applied before results leave
Confidentiality
- Bidder (DSP)
Separation of each advertiser's first-party data
- SSP or exchange
Separation of buyer and seller data
- Data platform (CDP, DMP)
Tenant isolation
- Clean room
No row-level data leaves the room
Privacy
- Bidder (DSP)
Use of consent signals in targeting
- SSP or exchange
Passing consent strings to buyers
- Data platform (CDP, DMP)
Notice, consent and deletion requests
- Clean room
Purpose limits on each collaboration
Table by AdSovereign, CC BY 4.0.
Processing integrity is the category most relevant to fee disputes, because it concerns whether processing is complete, accurate and authorised. It is optional, so a report used for billing questions is only useful if this category is in scope. Our clean room architectures compared page explains why aggregation thresholds differ between designs.
SOC 2 Type 1 vs Type 2
Type 1 covers "the design of the service organization's controls at a specific point in time". Type 2 covers "the design and operating effectiveness" of those controls "over a period of time" (Google Cloud, SOC 2 FAQ). A Type 1 shows the controls exist on paper and in configuration. A Type 2 shows, through samples, that they ran as described for months.
Periods differ by provider. AWS issues SOC 2 reports twice a year, each covering the previous 12 months, and releases them about nine to ten weeks after the period ends (AWS SOC FAQ). Google Cloud issues core SOC 2 Type II reports quarterly on rolling periods (Google Cloud, SOC 2).
New services often start with a design-level report. AWS describes its European Sovereign Cloud SOC 2 as an attestation "on the suitability of the design and implementation" of controls such as EU-resident operations and separation from other regions (AWS SOC FAQ). That wording describes design, not operating effectiveness over a period. Some vendors list both types: Kevel's security page names Type 1 and Type 2 (Kevel).
SOC 2 vs ISO 27001 for ad tech vendors
6 of 6 rows
What it is | An auditor's report on controls against the Trust Services Criteria | Certification of an information security management system |
Who issues it | A licensed CPA firm | An accredited certification body |
Output | A detailed report: system description, controls, tests, exceptions | A certificate with a scope statement |
Shared how | Under NDA or through a trust portal | Certificate often published; audit report not |
Time dimension | Type 2 covers a stated period | Certificate valid between surveillance audits |
Current version | 2017 criteria, revised points of focus 2022; 2027 drafts exposed (AICPA) | ISO/IEC 27001:2022 (Google Cloud, ISO 27001) |
What it is
- SOC 2
An auditor's report on controls against the Trust Services Criteria
- ISO/IEC 27001
Certification of an information security management system
Who issues it
- SOC 2
A licensed CPA firm
- ISO/IEC 27001
An accredited certification body
Output
- SOC 2
A detailed report: system description, controls, tests, exceptions
- ISO/IEC 27001
A certificate with a scope statement
Shared how
- SOC 2
Under NDA or through a trust portal
- ISO/IEC 27001
Certificate often published; audit report not
Time dimension
- SOC 2
Type 2 covers a stated period
- ISO/IEC 27001
Certificate valid between surveillance audits
Current version
- SOC 2
2017 criteria, revised points of focus 2022; 2027 drafts exposed (AICPA)
- ISO/IEC 27001
ISO/IEC 27001:2022 (Google Cloud, ISO 27001)
Table by AdSovereign, CC BY 4.0.
The two answer different questions. ISO 27001 says an organisation runs a management system for information security; Google Cloud notes the standard "does not mandate specific information security controls" (Google Cloud, ISO 27001). SOC 2 says how specific controls performed and lists the exceptions. Large cloud providers publish both, as Google Cloud's two compliance pages show.
How to read a vendor's SOC 2 report
A report runs to dozens of pages. This order gets to the useful parts first.
- Type and period. Confirm Type 2 and note the start and end dates. A period that ended long ago needs a bridge letter. AWS calls its version a SOC Continued Operations Letter, updated monthly (AWS SOC FAQ).
- Opinion. Read the auditor's opinion first. A qualified opinion means at least one criterion was not met.
- Scope. Check that the product you buy, and the regions that host your data, are named. AWS adds new regions "at the next available review cycle", so new locations can sit outside the latest report (AWS SOC FAQ).
- Categories. See which of the five categories are covered. For an ad platform that bills you, look for processing integrity; for a clean room, confidentiality.
- Subservice organisations. Most ad platforms run on a public cloud. The report should say whether the cloud provider's controls are carved out, in which case you also need that provider's report.
- Complementary user entity controls. These are controls the vendor expects you to run, such as reviewing your own users' access. Treat them as your obligations.
- Tests and exceptions. Read each exception and management's response. One exception in access reviews means something different from repeated failures in change management.
- Auditor. Note the firm. Google Cloud names Ernst & Young LLP and Coalfire as its auditors (Google Cloud, SOC 2).
- Red flags. The AICPA's Peer Review Board warns about engagements with identical reports across clients and unreasonable timelines, often linked to heavy reliance on third-party SOC platforms (Journal of Accountancy, 14 May 2026).
Our DSP RFP template includes security questions that sit alongside the report.
Ad tech vendors that state SOC 2 publicly
Each row reports what the vendor or a reputable outlet says, on the date shown. We did not read any vendor's report. A statement on a website is a company claim, not evidence of scope.
9 of 9 rows
The Trade Desk | DSP | SOC 1 and SOC 2 Type 2, external auditor | Published 11 Jan 2023 | |
GumGum | Contextual and attention platform | SOC 2 across the platform after an EY examination; Contextual first in 2023 | Published 11 Dec 2024 | |
Assertive Yield | Publisher yield optimisation | SOC 2 Type II | Published 20 Jan 2026 | |
Kevel | Ad serving APIs | "SOC 2 Compliant (Type 1 and 2)" (company claim) | Checked 9 Nov 2026 | |
Optable | Data collaboration | SOC 2 Type II listed among platform controls (company claim) | Checked 9 Nov 2026 | |
Decentriq | Clean room | "SOC2 certification" (company claim) | Checked 9 Nov 2026 | |
AWS | Cloud hosting clean rooms and bidders | SOC 1, 2 and 3 reports; separate European Sovereign Cloud SOC 2 | Checked 9 Nov 2026 | |
Google Cloud | Cloud | SOC 2 Type II issued quarterly | Checked 9 Nov 2026 | |
LiveRamp | Identity and clean room | Independent SOC 2 audits required by the proposed FTC order | Reported 2 Nov 2026 |
The Trade Desk
- Category
DSP
- Public statement
SOC 1 and SOC 2 Type 2, external auditor
- Date checked or published
Published 11 Jan 2023
- Source
GumGum
- Category
Contextual and attention platform
- Public statement
SOC 2 across the platform after an EY examination; Contextual first in 2023
- Date checked or published
Published 11 Dec 2024
- Source
Assertive Yield
- Category
Publisher yield optimisation
- Public statement
SOC 2 Type II
- Date checked or published
Published 20 Jan 2026
- Source
Kevel
- Category
Ad serving APIs
- Public statement
"SOC 2 Compliant (Type 1 and 2)" (company claim)
- Date checked or published
Checked 9 Nov 2026
- Source
Optable
- Category
Data collaboration
- Public statement
SOC 2 Type II listed among platform controls (company claim)
- Date checked or published
Checked 9 Nov 2026
- Source
Decentriq
- Category
Clean room
- Public statement
"SOC2 certification" (company claim)
- Date checked or published
Checked 9 Nov 2026
- Source
AWS
- Category
Cloud hosting clean rooms and bidders
- Public statement
SOC 1, 2 and 3 reports; separate European Sovereign Cloud SOC 2
- Date checked or published
Checked 9 Nov 2026
- Source
Google Cloud
- Category
Cloud
- Public statement
SOC 2 Type II issued quarterly
- Date checked or published
Checked 9 Nov 2026
- Source
LiveRamp
- Category
Identity and clean room
- Public statement
Independent SOC 2 audits required by the proposed FTC order
- Date checked or published
Reported 2 Nov 2026
- Source
Table by AdSovereign, CC BY 4.0.
Profiles with more detail: The Trade Desk, Kevel and Optable. Absence from the table means we did not find a public statement in this pass, not that a vendor lacks a report.
Where SOC 2 shows up in regulation and procurement
Federal cloud buying. FedRAMP's 2026 rules let a commercial product with a SOC 2 Type II and a mature security programme enter through a Class A certification. The first Class A certification was granted on 25 August 2026 (FedRAMP, 2 November 2026). Higher classes add federal-specific requirements. Isolation demands beyond that are covered in air-gapped ad tech.
Merger remedies. As reported, the proposed FTC order would require LiveRamp audits every six months for two years after closing, then annually. The order also requires commercial neutrality and bars Publicis from using LiveRamp customer data without authorisation. The FTC opened a 30-day comment period, and PPC Land did not report whether the order was final (PPC Land, 2 November 2026).
Health and finance. A SOC 2 report describes controls; it does not establish that a vendor meets a sector law. Our review of HIPAA marketing platforms explains why HHS does not recognise private certifications. The live guide to ad tech compliance: PCI, HIPAA and SOC 2 shows how the frameworks combine. Related pages sit in our ad tech compliance hub.
FAQ
Is SOC 2 a certification?
What is the difference between SOC 2 Type 1 and Type 2?
Do ad tech vendors need SOC 2?
SOC 2 or ISO 27001: which matters more for ad tech?
How do I get a vendor's SOC 2 report?
How this works on owned infrastructure
The reading checklist above keeps returning to scope: which systems, which regions and which subservice providers a report covers. When an ad stack runs inside the buyer's own environment, much of that scope moves into the buyer's own controls and its own auditor's sample. AdSovereign is an enterprise, on-premise RTB stack (DSP, SSP, exchange and clean room) designed so that access logs, configuration changes and bid records stay in the customer's systems, where its auditors can test them directly. That changes who holds the evidence; it does not replace a report. The security page describes logging and access controls, and the architecture page shows the deployment boundary.
Sources
- AICPA and CIMA, "2017 Trust Services Criteria (With Revised Points of Focus, 2022)" (resource page). https://www.aicpa-cima.com/resources/download/2017-trust-services-criteria-with-revised-points-of-focus-2022
- AICPA and CIMA, "AICPA Exposure Drafts: Proposed 2027 SOC 2 Trust Services Criteria and Description Criteria" (26 October 2026). https://www.aicpa-cima.com/resources/download/aicpa-exposure-drafts-proposed-2027-soc-2-trust-services-criteria-and-description-criteria
- AICPA and CIMA, "System and Organization Controls: SOC Suite of Services" (checked 9 November 2026). https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-2
- Tim Kindem, "AICPA guides peer reviewers to address SOC 2 risks", Journal of Accountancy (14 May 2026). https://www.journalofaccountancy.com/issues/2026/may/aicpa-guides-peer-reviewers-to-address-soc-2-risks/
- Google Cloud, "SOC 2" compliance page and FAQ (checked 9 November 2026). https://cloud.google.com/security/compliance/soc-2
- Google Cloud, "ISO/IEC 27001" compliance page (checked 9 November 2026). https://cloud.google.com/security/compliance/iso-27001
- AWS, "SOC FAQs" (checked 9 November 2026). https://aws.amazon.com/compliance/soc-faqs/
- FedRAMP, "Choose a Class" (Consolidated Rules for 2026). https://www.fedramp.gov/2026/providers/start/class/
- FedRAMP, "Memo to Milestone: FedRAMP Grants the First Full FedRAMP 20x Class C Certification" (2 November 2026). https://www.fedramp.gov/2026-11-02-memo-to-milestone/
- PPC Land, "Publicis acquires LiveRamp, the data hub its agency rivals rely on" (2 November 2026). https://ppc.land/publicis-acquires-liveramp-the-data-hub-its-agency-rivals-rely-on/
More sources (6)
- The Trade Desk, "The Trade Desk Becomes One of the First Media-Buying Platforms to Achieve SOC 1 and SOC 2 Compliance" (11 January 2023). https://www.thetradedesk.com/press-room/the-trade-desk-becomes-one-of-the-first-media-buying-platforms-to-achieve-soc-1-and-soc-2-compliance
- GumGum, "The GumGum Platform Achieves Global SOC 2 Compliance" (11 December 2024). https://gumgum.com/press-releases/soc2-gumgum-platform
- ExchangeWire PressBox, "Assertive Yield Achieves SOC 2 Certification" (20 January 2026). https://www.exchangewire.com/blog/2026/01/20/assertive-yield-achieves-soc-2-certification-reinforcing-commitment-to-data-security-operational-excellence/
- Kevel, Security page (checked 9 November 2026). https://www.kevel.com/security
- Optable, Platform overview (checked 9 November 2026). https://www.optable.co/platform-overview
- Decentriq, Data clean rooms page (checked 9 November 2026). https://www.decentriq.com/data-clean-rooms
Changelog
- 9 November 2026: page created with nine vendor rows and the AICPA 2027 exposure drafts.