# Do I need SOC 2 to license data to AI?

> Searching whether you need SOC 2 to sell data to AI? I found no rule or term that asks a licensing company for one. Read any buyer's SOC 2 report itself.

By Matt Burns, Vaultfish. Canonical: https://vaultfish.com/answers/do-i-need-soc-2-to-sell-data-to-ai  
Published: 2026-07-08  
Updated: 2026-10-14

## The short answer

No statute or buyer term requires it. SimpleClosure's terms and Troveo's guide ask for promises about your rights, consents and lawful collection. Mercor claims SOC 2 Type II. Whistleblower allegations surfaced against Delve on fraudulent reports. Ask to read any buyer's SOC 2 report.

SOC 2 is a report from an independent auditor on a company's security controls. Buyers and vendor-risk teams ask suppliers for it. An owner is rarely the supplier under review.

## What do buyers actually ask an owner for?

The published terms for owners focus on rights. [SimpleClosure's terms](https://simpleclosure.com/tos/) have the owner represent that it got all required consents from individuals whose personal information is in the assets. [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals) says you promise two things. You hold the rights you are licensing, and the data was acquired lawfully.

Neither asks the owner for a security report. Other deals may differ, so read the terms in front of you.

## Do the companies claim SOC 2?

Of the buyer pages I read, [Mercor's](https://www.mercor.com/data/) names SOC 2 Type II. I couldn't find the auditor, scope or observation period on that page. The micro1, [Troveo](/buyers/troveo) and [SimpleClosure](/buyers/simpleclosure) pages I read didn't claim a certification.

All of these are self-reported statements.

## Why does the Delve story matter?

Jackson Lewis wrote an [article](https://www.workplaceprivacyreport.com/2026/05/articles/governance-risk-and-compliance-2/the-delve-scandal-why-a-soc-2-report-cant-be-a-check-the-box-exercise-for-vendor-management/). It reports that whistleblower investigators alleged Delve, a compliance startup, generated fraudulent audit reports. They also alleged it fabricated evidence of controls for hundreds of customers. These are allegations, not findings.

The article's advice is to read the reports you receive with care.

## What should I read in a buyer's SOC 2 report?

Jackson Lewis lists four checks:

- Whether the systems you depend on are covered or carved out.
- How stale the observation period is.
- Who did the audit, and whether they had evident conflicts.
- Whether results look realistic. Zero incidents across dozens of organizations deserves curiosity.

Ask the buyer for the report under NDA. Bring it to your security lead or a CPA firm that does SOC 2 audits.

Our [buyers page](/buyers) records what each buyer publishes about security. The [safety page](/answers/is-it-safe-to-sell-company-data-to-ai) covers the [Mercor](/buyers/mercor) breach.

Figure: steps Scope and test dates -> Auditor independence -> Realism of findings. Jackson Lewis lists what to read in a SOC 2 report before relying on it.

_Vaultfish helps you run the process. We are not lawyers and this is not legal advice. If you need counsel who knows this area, we can point you to one._

## Sources

- [SimpleClosure's terms](https://simpleclosure.com/tos/)
- [Troveo's licensing guide](https://www.troveo.ai/resources/ai-data-licensing-deals)
- [Mercor's](https://www.mercor.com/data/)
- [article](https://www.workplaceprivacyreport.com/2026/05/articles/governance-risk-and-compliance-2/the-delve-scandal-why-a-soc-2-report-cant-be-a-check-the-box-exercise-for-vendor-management/)

micro1 may pay us a referral fee if a company we introduce goes ahead with it. [How we are paid](https://vaultfish.com/disclosure)