SOC 2 Type II: What It Actually Means for Your Election Security
When evaluating online voting vendors, you'll often see "SOC 2 certified" listed as a security credential. But there's a significant difference between SOC 2 Type I and SOC 2 Type II — and most vendors don't explain it clearly.
Type I vs. Type II: The Critical Difference
A SOC 2 Type I report is a point-in-time assessment. An auditor reviews the vendor's security controls as they exist on a single day and certifies that the controls are designed appropriately. It says nothing about whether those controls actually work over time.
A SOC 2 Type II report covers a minimum six-month observation period. The auditor tests whether the controls operated effectively throughout that period. This is a fundamentally stronger assurance — and it's what Votem holds.
What the Five Trust Service Criteria Cover
SOC 2 reports are organized around five Trust Service Criteria:
- Security: Protection against unauthorized access (required for all SOC 2 reports)
- Availability: System uptime and performance commitments
- Processing Integrity: Completeness and accuracy of data processing
- Confidentiality: Protection of confidential information
- Privacy: Collection, use, and disposal of personal information
Votem's SOC 2 Type II report covers all five criteria — not just the Security baseline that many vendors report against.
Why This Matters for Election Integrity
For organizations running member elections, Processing Integrity is the most critical criterion. It provides independent assurance that every ballot cast was counted accurately, that no votes were added or removed, and that the certified results reflect the actual votes cast.