Kontent.ai’s SOC 2 Type II report for headless CMS buyers

We have completed another SOC 2 Type II examination (also written SOC 2 Type 2), in which an independent auditor tested how our security controls operated over a full year.

Our SOC 2 Type II report at a glance

• Report: SOC 2 Type II, an independent audit against the AICPA Trust Services Criteria
• Period: 12 months ending on 1 February, with a new report every year
• System: the Kontent.ai platform, hosted on Microsoft Azure (see our security policy)
• Access: through our Trust Center, under a mutual NDA

What is SOC 2 Type II, and how does it differ from Type I?

SOC 2 is an auditing procedure designed for service providers storing customer data in the cloud. There are two types of SOC 2; while the SOC 2 Type 1 focuses on the procedures and controls relating to one or all of the so-called Trust Services Criteria (TSC) that a company has put in place as of the time of evaluation, the SOC 2 Type 2 assesses how effective the controls in place are over a longer period of time.

The auditor tested our controls against three Trust Services Criteria:

• Security: information and systems are protected against unauthorized access, unauthorized disclosure of information and damage to systems. Every SOC 2 report includes these common criteria.
• Availability: information and systems are available for operation and use to meet the entity’s objectives.
• Confidentiality: information designated as confidential is protected to meet the entity’s objectives.

AI in the next SOC 2 criteria

In October 2026, the AICPA proposed updated Trust Services Criteria that add AI governance and prompt manipulation to the points of focus. Comments close on 15 January 2027, and if the update is approved, it applies to engagements beginning on or after 31 December 2027.

In an agentic CMS, people and AI agents both change content, and AI governance has to cover the agents’ changes. Our audit log shows whether a person, Aiko or an expert agent changed a content item or the content model, so your team reviews agent and human changes in one place.

SOC 2 at Kontent.ai since 2019

Since earning our first SOC 2 Type 1 report in 2019, we have received a new SOC 2 Type 2 report every year from 2020.

For the rest of our security program, including ISO/IEC 27001 and penetration testing, read our Trust and Governance page.