SOC 2 and Data Security for Real Estate Brokerages: What a Report Covers, What to Ask Vendors and What the Law Requires

What a SOC 2 report is

What is a SOC 2 report?

SOC 2 is an examination performed by a licensed, independent CPA under the AICPA’s attestation standards. It evaluates a service organization’s controls over the security, availability, processing integrity, confidentiality or privacy of its systems. For a brokerage, that means any vendor that stores its files and its clients’ information, and the AICPA names vendor management programs among the reports’ uses.

The AICPA’s illustrative Type 2 report has four parts: management’s assertion, the description of the system, the service auditor’s report, and the tests of controls with their results.

A SOC 2 is a report, not a certificate or a checklist. The criteria describe outcomes, and the vendor designs its own controls to meet them; the AICPA’s points of focus are not each required. So a SOC 2 does not by itself mean a vendor encrypts stored data or offers multi-factor sign-in. The system description and the tests show which controls it has.

On October 28, 2026 the AICPA proposed 2027 Trust Services Criteria, adding points of focus on AI governance, model monitoring and training data. Comments close January 15, 2027; if approved, the new criteria apply to engagements beginning on or after December 31, 2027.

Type 1, Type 2 and SOC 3

What is the difference between SOC 2 Type 1 and Type 2?

Both cover management’s description of the system and whether its controls are suitably designed to meet the criteria. A Type 2 report adds an opinion on whether the controls operated effectively throughout a specified period, and a detailed description of the auditor’s tests and their results. A Type 1 report has neither, so only the Type 2 shows how the controls performed over time.

A SOC 3 report gives an opinion on the same categories without the detailed tests. The AICPA treats it as a general use report that can be freely distributed; the use of SOC 2 reports is restricted. A SOC 1 covers controls relevant to a customer’s financial reporting, for the customer and its auditors.

How to get a vendor’s report, and what to read in it

How do I get a copy of a vendor’s SOC 2 report?

Ask the vendor. Because the use of SOC 2 reports is restricted, expect to request one rather than download it, and a vendor may ask you to sign a nondisclosure agreement first. When it arrives, read:

• The period. If it ended months ago, ask for a bridge letter for the time since.
• The categories beyond security, and the system: check that the product you will use is in management’s description.
• Subcontractors. Federal banking agencies suggest that banks consider whether a vendor’s SOC reports call for a closer look at the vendor or its contractors. Ask about the cloud host.
• The results of each test, not only the opinion.
• Your part. Complementary user entity controls are the steps the customer must take for the vendor’s controls to work, such as removing access for people who leave.

What is a SOC 2 bridge letter?

A letter from the vendor’s management, not the auditor, covering the time since the report period ended. CMS, which requires them from its Medicare contractors, says one must name the CPA firm, the report date and period, the date through which management speaks and any material changes to controls, and must state that it is not a substitute for the report. The U.S. Treasury’s Bureau of the Fiscal Service publishes its own bridge letters with the same disclaimer.

What to ask any software vendor

What security questions should a brokerage ask a software vendor?

The FTC tells businesses to put security expectations in writing in contracts with service providers, verify compliance, and insist that providers report security incidents. These questions cover what your own duties depend on:

Email accounts need the same care. The FTC warns homebuyers that scammers send emails impersonating a loan officer or real estate professional and ask them to wire closing costs to a different account; see our guide to protecting your brokerage from wire fraud.

A brokerage’s own duties

What does a brokerage have to do if client data is breached?

The business that owns or licenses the data carries the notice duty, even when the breach happens at a vendor: the vendor notifies the owner, and the owner notifies the people affected.

Cal. Civ. Code 1798.82 (as amended by SB 446), Tex. Bus. & Com. Code 521.053, Fla. Stat. 501.171 and N.Y. Gen. Bus. Law 899-aa, read on November 3, 2026. Each allows a delay for law enforcement. They cover defined personal information, such as a name with a Social Security, driver’s license or account number; California and Texas exclude encrypted data unless the key was also taken.

• Reasonable security. California, Texas, Florida and New York require businesses to keep reasonable security for the personal information they hold.
• Vendor contracts. New York counts choosing capable service providers, and requiring safeguards by contract, among reasonable safeguards. California requires that contract term with a nonaffiliated third party its security statute does not already cover.
• Disposal. Texas and Florida require records that are no longer to be kept to be shredded, erased or made unreadable.
• A written program. NAR offers brokerages a data security and privacy toolkit for building one.

How long must a brokerage keep transaction records?

California requires three years from closing, or from the listing date if the sale does not close. Texas requires four years from closing, termination of the contract or the end of the transaction, readily available to TREC. Periods in 11 states are in our guide to brokerage compliance. After that, the FTC’s advice to keep sensitive data only as long as there is a business need, and the disposal rules above, take over.

Security and SOC 2 in SkySlope

What SkySlope publishes about the security of its platform, with the date of each source:

• SOC 2. In April 2022 SkySlope announced that it had obtained SOC 2 Type 1 and Type 2 reports, from an external audit firm, for three categories: security, availability and confidentiality. It named encryption in transit and at rest, encrypted employee laptops, regular backups, data kept in multiple geographic regions, reviewed and tested code changes, monitoring, code scanning and independent penetration testing, with “a target of 99.99% uptime.”
• Hosting and staff access. SkySlope wrote in 2020 that production runs inside Amazon Web Services, reached only through a VPN protected by multi-factor authentication, with strict role-based, need-to-know access.
• Single sign-on. Members can sign in with credentials from the brokerage’s own identity provider, using SAML 2.0 or OpenID Connect; the brokerage makes sure that service meets its security requirements.
• Your own copy. Client Document Replication Services copies a brokerage’s documents to its own Box.com account in real time, for retention; Box servers in Toronto and Montreal keep Ontario and Quebec documents in the province.
• Storage and exit. The Terms of Use (February 2026) say storage depends on the plan and advise exporting documents you want to keep. The subscription agreement provides a .zip of the brokerage’s documents and data on request within 30 days after termination; after that SkySlope deletes them unless the law prevents it.
• Deletion and breach notice. The privacy notice (January 2025) says accounts are deleted through your SkySlope account manager, information may remain on backup servers indefinitely, and SkySlope may attempt to notify you of a breach by email, phone, mail or a posting on your account page. Security questions go to [email protected].

A 2022 announcement describes the report SkySlope had then. Ask for the current Type 2 report and a bridge letter, as you would from any vendor, and check that the products you use, such as DigiSign, are in it.

FAQ