SOC 2 Confidentiality vs Privacy: Which Does Your SaaS Report Need?

SOC 2 Confidentiality and Privacy answer different questions. Confidentiality concerns information your service designates as confidential. Privacy concerns personal information and how you collect, use, retain, disclose, and handle it under your commitments. A SaaS product may hold both, but the data labels alone do not select its report categories. Ask the intended report user what it needs, map the service and promises behind that request, and review the proposed scope with your CPA firm.

SOC 2 Confidentiality vs Privacy: what changes in the report?

The AICPA Trust Services Criteria set a Security baseline through the Common Criteria. A report that includes Confidentiality or Privacy also addresses that category’s criteria. The five-category guide explains the full set; this choice needs a closer look at the information and commitments in your own service.

Question	Confidentiality	Privacy
Which information is in focus?	Information designated as confidential, such as customer source code covered by an agreement.	Personal information, such as identifiable user profiles or account records.
Which promise should you inspect?	How you protect confidential information and dispose of it under your commitments.	What your privacy notice, contracts, and service commitments say about the personal information lifecycle.
What should a report user ask?	Does the report examine the additional Confidentiality criteria for this service?	Does the report examine the additional Privacy criteria for this service and its stated privacy commitments?

These categories can overlap. A customer file can contain both trade secrets and personal information. Classifying the file as confidential does not answer how your service uses a person’s data. Likewise, a privacy notice does not by itself show that a CPA examined the Confidentiality criteria. Read the actual report scope rather than inferring it from a data label.

When should you propose Confidentiality, Privacy, or both?

Start with the service boundary and the buyer’s exact request. Consider a code-review SaaS that stores customer repositories and account profiles. The buyer may care most about the confidential source code it uploads. Another report user may ask about personal information in the product. If both questions matter, propose both categories for discussion. None of those facts automatically dictates the CPA engagement.

Before selecting a category, write one row for each information flow:

Field	Example entry
Scoped service and flow	Customer repository upload and review
Information and people affected	Customer source code; named account holders
Written commitment	Contract restricts access to uploaded code; privacy notice describes account-data use
Report user request	Procurement asks whether Confidentiality and Privacy are in the report
Proposed category and reason	Confidentiality for designated code; Privacy for account-data handling if the report user needs it
Control owner and source evidence	Engineering owner; access changes, retention settings, and approved deletion records in their source systems
Open question for CPA firm	Whether each flow, commitment, and proposed criterion belongs in the intended report

This record makes the question specific enough for a buyer and CPA firm to answer. If procurement only wrote “SOC 2 required,” use the customer-request guide to ask which service, categories, and report date or period it will accept. Do not promise Privacy in a sales reply because your product stores email addresses.

What if you plan a Security-only report?

Security’s Common Criteria are the SOC 2 baseline, but a Security-only scope does not mean the CPA examined every Confidentiality or Privacy criterion. It may meet the buyer’s request, or it may leave their specific question unanswered. Compare the proposed criteria with the request before you commit to timing or describe the report externally.

Management still needs to honor confidentiality promises and privacy duties outside the report. Category selection sets the boundary of this examination; it does not switch those obligations on or off. The AICPA’s SOC 2 description criteria also govern how management describes the scoped system, so keep the service and its commitments accurate regardless of the categories selected.

If you add a category after work has begun, ask the CPA firm whether the relevant controls operated and whether source evidence covers the intended date or period. Do not backfill a missing history or assume your team’s candidate dates are the agreed examination period.

Does a Privacy category answer a GDPR request?

No. The AICPA’s criteria define a SOC 2 control examination, while GDPR addresses legal duties for personal-data processing. Even a report that includes Privacy has a stated service and control scope. It does not decide your legal roles, transfer obligations, or every processing activity. The European Data Protection Board’s guidance describes the GDPR’s separate personal-data duties. If an EU buyer asks for both a report and a data processing agreement, use the SOC 2 and GDPR guide and have privacy counsel review the legal side.

You can keep the category decision, criteria mapping, controls, and safe evidence references in FileGRC’s Git-native GRC workspace. JSON holds structured records, Markdown holds long-form work, and Git supplies the change history. Starter records are proposals, not compliance claims. Keep sensitive source data in its approved systems. FileGRC does not operate those systems, choose your categories, perform the examination, or decide whether the evidence is sufficient; the CPA firm handles the examination and evidence judgment.