SOC 2 · Type II · annual 01
Security
Protection against unauthorized access. Covers encryption, access controls, firewalls, intrusion detection, and incident response.
SOC 2 · Type II · annual
SOC 2
Type II.
How DialPhone maps its controls to the SOC 2 Trust Services Criteria. Report type, service scope, observation period and auditing firm are provided on request rather than published here.
Evidence status. This page describes the controls DialPhone operates. It is not itself evidence of a certification, attestation or authorization. Ask DialPhone for the underlying artifact, its scope and its validity dates, and verify any authorization against the official registry, before relying on it in procurement. Contact sales for current documentation.
SOC 2 is the baseline procurement checkbox most enterprise security reviews require. The distinction that matters: Type II versus Type I. Type I attests that controls were designed appropriately on a specific date; Type II attests that those controls operated effectively over a 6- to 12-month observation window. Type II is what mid-market and enterprise procurement teams expect, because it tests whether the program holds up day-to-day, not whether it looked good at audit time.
DialPhone maps its control set to four of the five Trust Services Criteria: Security (the always-required core), Availability (which matters for any phone system where downtime equals dropped customer calls), Confidentiality (which matters for any platform handling sensitive customer conversations), and Processing Integrity (which matters for messaging and AI inference paths where data must arrive complete and uncorrupted). Privacy is covered separately via the GDPR and CCPA programs.
A SOC 2 Type II report runs to roughly 80-140 pages and includes subprocessor scope, control descriptions and the auditor's opinion. Those pages, not a marketing page, are what a security review should be reading. Request the current report, its type, its scope and its period via sales. For the broader compliance footprint across HIPAA, PCI-DSS, ISO 27001, and FINRA, see the Trust Center.
Trust Services Criteria
Four criteria covered
-
-
02
Availability
System accessibility for operation and use. Covers uptime, disaster recovery, capacity planning, and monitoring.
-
03
Confidentiality
Data classified as confidential is protected. Covers data classification, retention, secure destruction, and NDA enforcement.
-
04
Processing Integrity
System processing is complete, accurate, timely, and authorized. Covers data validation, reconciliation, and error handling.
Get the report
Request access
Customers receive the report on request via the admin portal. Prospects receive it under NDA, contact sales or email support@dialphone.com.
SOC 2 FAQ
Can I get a copy of the SOC 2 report?
Request it from sales or support@dialphone.com. Ask specifically for the report type, the service scope it covers, the observation period and the auditing firm. Do not treat this page as a substitute for that document.
Who audits DialPhone?
The auditing firm is named in the report itself. DialPhone does not publish the firm name on this page; request the report and confirm the firm, its AICPA membership and the report type directly.
What period does the report cover?
A SOC 2 Type II report covers an observation period, typically 6 to 12 months. DialPhone does not publish its current report period here. Ask for the exact period and confirm it is current before relying on it.
What if there are exceptions?
A SOC 2 audit produces a Management Response Letter addressing any exceptions or control deviations, and the remediation plan sits inside the report. Read that section yourself rather than accepting a summary of it from a vendor page.
Is this SOC 2 Type I or Type II?
Type II. Type I only attests to control design at a point in time; Type II attests that controls operated effectively over a period (12 months). Type II is the standard for production SaaS.