SOC 2 Compliance in India: How Indian SaaS and IT Companies Get a CPA-Signed Report

Cost and timeline content is left out on purpose, in line with the standing Accorp restriction. The blog starts below.

An Indian SaaS company usually hears about SOC 2 for the first time from a customer. A US buyer likes the product, the commercial terms are agreed, and then the security team sends a vendor questionnaire with one line that stalls the deal: "Please share your latest SOC 2 report."

SOC 2 compliance in India works the same way it does in the United States, with one detail that catches many founders off guard. The report has to be signed by a licensed CPA firm. A consultant cannot issue it, a compliance tool cannot generate it, and an Indian Chartered Accountant cannot sign it in that capacity.

This guide explains what the report is, who is allowed to sign it, and the steps an Indian SaaS or IT services company goes through to get one.

What SOC 2 is, and why a CPA has to sign it

SOC 2 stands for System and Organization Controls 2. It was created by the American Institute of Certified Public Accountants (AICPA) for companies that store or process customer data on behalf of other businesses. If you want a plain-language primer first, read what SOC 2 compliance really means.

People call it a certification, but there is no SOC 2 certificate. What you receive is an attestation report. An independent auditor examines your controls and gives a formal opinion on them, and that opinion is the part your customer's security team reads first.

The examination is performed under the AICPA's attestation standards, and those standards allow only a licensed CPA firm to issue the report. This is why the signature matters so much. A document titled "SOC 2 report" that carries a consultant's logo and no CPA firm's opinion will be rejected in vendor due diligence, however thorough the work behind it.

A complete report contains four parts:

• The independent auditor's opinion

• Management's assertion, signed by your leadership

• A description of your system: services, infrastructure, people, data and boundaries

• The controls tested and the results of each test (in a Type 2 report)

The report is a restricted-use document. Companies share it with customers and prospects under an NDA; it is not something you post on your website.

The Trust Services Criteria: what goes into scope

Your controls are measured against the AICPA Trust Services Criteria. There are five categories, and only one of them is compulsory.

Most Indian SaaS companies start with Security alone or Security plus Availability. Add a category when a customer contract or your own service commitments call for it. Every extra category brings more controls to run and more evidence to produce, so scope should follow what you have promised customers.

Type 1 or Type 2: which report will your customer accept?

A Type 1 report tells the customer your controls exist. A Type 2 report tells them the controls kept working. Many Indian companies take a Type 1 first to answer an urgent customer request and then move into a Type 2. Before you choose, ask the customer which type their vendor policy requires, because some enterprise buyers accept only Type 2.

How an Indian company gets a CPA-signed SOC 2 report

1. Define the system and scope. Decide which product, which infrastructure and which legal entities the report will cover. If your contracts are signed by a US parent and the engineering team sits in an Indian subsidiary, both usually belong in the system description.

2. Run a readiness assessment. Your existing practices are compared with the criteria in scope and the gaps are listed. Indian startups tend to find the same ones: no formal access reviews, offboarding that depends on memory, vendor checks that were never written down, and an incident response plan nobody has tested.

3. Close the gaps. Write the policies, switch on the technical controls and assign an owner to each one. The SOC 2 compliance checklist covers the documents and controls auditors expect to see. Penetration testing is commonly requested at this stage, and a VAPT testing company can supply that evidence.

4. Operate the controls and collect evidence. For a Type 2 report, the controls must run through the whole observation period. A quarterly access review that happened once will show up as an exception in the report.

5. Engage the licensed CPA firm. The firm confirms its independence, agrees the scope with you and issues an engagement letter. Management prepares the system description and signs the assertion.

6. Fieldwork. The auditor interviews control owners, inspects configurations and tests samples. Here is what SOC 2 auditors look for when reviewing evidence. For Indian teams this is nearly always done remotely through screen shares and an evidence portal.

7. The report is issued. The CPA firm signs its opinion and delivers the report. An unqualified opinion is the clean result. If controls failed, the opinion may be qualified and the exceptions are listed, so it is better to fix weak controls before the period begins than to explain them afterwards.

Customers ask for a current report every year, so SOC 2 becomes an annual cycle once the first report is out.

SOC 2 audit in India: who does what

Three kinds of providers work on a SOC 2 audit in India, and they are often confused with each other.

Independence is the rule that shapes this split. The auditor can assess your readiness and tell you where the gaps are. The auditor cannot design and run your controls and then give an opinion on them, because management has to own the controls.

Before you sign with anyone, ask one question: which CPA firm's name will appear on the opinion, and where is that firm licensed? If the answer is vague, the report may be subcontracted to a firm you have never spoken to. Ask also whether the firm is enrolled in AICPA peer review, since large customers sometimes check the auditor's credentials along with the report.

SOC 2 report in Bangalore and other Indian tech hubs

A SOC 2 report in Bangalore is examined against the same criteria as one issued to a company in San Francisco. The standard has no city or country version. What differs is the set of practical issues Indian companies bring to the audit, and Bengaluru's SaaS companies, IT services firms and global capability centres see them most often. The same points apply in Hyderabad, Pune, Chennai, Gurugram and Noida.

• Two entities, one system. Many Bengaluru startups are owned by a Delaware parent with the product team in an Indian subsidiary. The system description has to explain which entity does what. The same structure also creates India-side filings, including the APR audit of the overseas subsidiary for Indian companies that hold equity in a US entity.

• Cloud providers as subservice organizations. If you host on AWS, Azure or Google Cloud, the report normally carves out the provider's data centre controls and relies on the provider's own SOC report. Your controls over configuration, access and monitoring remain in scope.

• Co-working offices. Physical security in a shared office is partly the operator's responsibility. Auditors will ask how you control devices and access in a space you do not manage.

• Contractors and outsourced teams. Background checks, security training and offboarding must cover contract staff and vendor engineers who can reach production.

• Personal devices. A bring-your-own-laptop culture needs device management and disk encryption before the audit starts.

• AI features. If your product calls an LLM provider or runs its own models, expect extra evidence requests. See SOC 2 for AI companies in 2026.

SOC 2 alongside ISO 27001 and the DPDP Act

Indian IT companies often hold ISO 27001 already, because European and domestic clients ask for it. The two do different jobs. ISO 27001 certifies a management system and gives you a certificate. SOC 2 gives your customer a detailed report with an auditor's opinion, and it is the document US buyers ask for by name. Our comparison of SOC 2 vs ISO 27001 vs HIPAA explains which one to take up first.

An existing ISMS shortens the SOC 2 work considerably. Risk assessments, access policies and internal audits built for the ISO 27001 certification process can be mapped to the Trust Services Criteria and reused as evidence. Cloud providers that sell to regulated buyers sometimes add CSA STAR on top of SOC 2.

India's Digital Personal Data Protection Act, 2023 is a separate matter. It is law, and a SOC 2 report does not prove compliance with it. The controls do overlap: access restriction, breach response and retention rules built for SOC 2 support your DPDP obligations, particularly if the Privacy category is in scope.

Choosing SOC 2 compliance services in India

Providers of SOC 2 compliance services in India range from two-person consultancies to global audit firms. These questions separate them quickly:

• Is the firm itself a licensed CPA firm, or does it hand the attestation to a partner?

• Who signs the opinion, and can you speak to that team before the engagement starts?

• Has the audit team worked with your stack, whether that is a multi-tenant SaaS product on AWS, a managed services operation or a fintech platform?

• Will they review your scope and system description early, so problems surface before fieldwork?

• Do they work in Indian business hours and understand structures such as a US parent with an Indian subsidiary?

• Can the same firm cover the other frameworks your customers ask for, so evidence is collected once and reused?

Accorp Partners is a CPA-led firm, and its licensed CPA auditors issue SOC 2 Type 1 and Type 2 reports for SaaS and IT companies in India and abroad. The work runs from readiness assessment to the signed report, with Indian founders and security leads dealing directly with the audit team.

If a customer has asked for your report, talk to our team about SOC 2 audit services and get your scope reviewed before you commit to a report type.

Frequently asked questions

1. Is SOC 2 compliance mandatory in India?

No Indian law requires it. SOC 2 is a contractual requirement that comes from customers, mostly in the United States, who will not onboard a vendor without a current report.

2. Can an Indian Chartered Accountant issue a SOC 2 report?

No. SOC 2 is an AICPA framework and the report must be issued by a licensed CPA firm. A Chartered Accountant or consultant in India can help you prepare, but the opinion has to carry a CPA firm's signature.

3. Does my company need a US entity to get a SOC 2 report?

No. An Indian private limited company can be the service organization named in the report. The auditor examines the system that delivers your service, wherever the legal entity is registered.

4. Is there a SOC 2 certificate?

No. You receive an attestation report with the auditor's opinion. Companies that say they are "SOC 2 certified" mean they hold a report with a clean opinion.

5. Does the auditor have to visit our office in Bangalore?

In most cases, no. Evidence is shared through a secure portal and walkthroughs happen over video calls. Cloud-hosted companies with small offices rarely need an on-site visit.

6. We use AWS, which already has a SOC 2 report. Does that cover us?

It covers AWS's data centres and infrastructure. It does not cover how you configure your account, who has access, how you deploy code or how you respond to incidents. Those controls are yours and need their own report.

7. Should we start with Type 1 or Type 2?

Check what your customer's vendor policy asks for. If they accept Type 1, it answers the immediate request and gives you a baseline. If they insist on Type 2, plan for that from the start.