Do I need SOC 2 to license data to AI?
The short answer
No statute or buyer term requires it. SimpleClosure's terms and Troveo's guide ask for promises about your rights, consents and lawful collection. Mercor claims SOC 2 Type II. Whistleblower allegations surfaced against Delve on fraudulent reports. Ask to read any buyer's SOC 2 report.
SOC 2 is a report from an independent auditor on a company's security controls. Buyers and vendor-risk teams ask suppliers for it. An owner is rarely the supplier under review.
What do buyers actually ask an owner for?
The published terms for owners focus on rights. SimpleClosure's terms have the owner represent that it got all required consents from individuals whose personal information is in the assets. Troveo's licensing guide says you promise two things. You hold the rights you are licensing, and the data was acquired lawfully.
Neither asks the owner for a security report. Other deals may differ, so read the terms in front of you.
Do the companies claim SOC 2?
Of the buyer pages I read, Mercor's names SOC 2 Type II. I couldn't find the auditor, scope or observation period on that page. The micro1, Troveo and SimpleClosure pages I read didn't claim a certification.
All of these are self-reported statements.
Why does the Delve story matter?
Jackson Lewis wrote an article. It reports that whistleblower investigators alleged Delve, a compliance startup, generated fraudulent audit reports. They also alleged it fabricated evidence of controls for hundreds of customers. These are allegations, not findings.
The article's advice is to read the reports you receive with care.
What should I read in a buyer's SOC 2 report?
Jackson Lewis lists four checks:
- Whether the systems you depend on are covered or carved out.
- How stale the observation period is.
- Who did the audit, and whether they had evident conflicts.
- Whether results look realistic. Zero incidents across dozens of organizations deserves curiosity.
Ask the buyer for the report under NDA. Bring it to your security lead or a CPA firm that does SOC 2 audits.
Our buyers page records what each buyer publishes about security. The safety page covers the Mercor breach.
Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one. Ask for a referral
