Glossary · SOC and attestation
If customers rely on your controls, you are the service organization in their audit.
A company that provides services to other organizations, called user entities, where its controls affect those customers' own reporting or security.
Back to the glossary01 · In plain words
In plain words
A company that provides services to other organizations, called user entities, where its controls affect those customers' own reporting or security.
When you run something for a customer, like payroll, hosting or claims handling, your controls become part of theirs. In SOC language you are the service organization and your customers are user entities. The SOC report is about you.
02 · Why it matters
Why it matters
Who cares about this, and what depends on it.
Being a service organization is not a status you apply for. It follows from what you do for customers. Once a customer's auditor or security team depends on your controls, they will want evidence about them, and a SOC report is the standard way to give it once rather than answering every customer separately. The term also sets responsibilities. The service organization defines the system, writes the description, signs the assertion and runs the controls. It also has to say what customers must do on their side and which vendors it relies on.
03 · Where you meet it
Where you will meet it
The documents, meetings and reports where it appears.
- The title page of a SOC report
- The report names the service organization and the system examined.
- The system description
- The service organization describes its services, boundaries, people and vendors here.
- Customer contracts
- Clauses often require the service organization to provide a current SOC report each year.
- A user auditor's planning
- The customer's financial auditor identifies which service organizations matter to its audit.
04 · An example
A worked example
An illustration, not a real client.
Illustrative: an insurance claims processor in Noida
A business process company keys and validates health insurance claims for three insurers. Each insurer's auditor asks how claims are checked before payment. The company realises it is a service organization for these customers and that its claims checks feed their financial statements. Rather than hosting three separate audit visits, it pursues a SOC 1 report that each insurer's auditor can use.
05 · Easy to mix up
Easy to mix up with
Neighbouring terms that mean something different.
- Subservice organization
- A vendor the service organization itself uses, such as its cloud host. It sits one layer further out.
- User entity
- The customer that relies on the service organization. The report is written about the service organization for user entities to read.
06 · What to do
What to do with it
Practical steps, and the guides that go deeper.
- List which customers rely on your controls, and for what: financial reporting, security, or both.
- Identify the vendors you depend on, since they may appear as subservice organizations.
- Write down what customers must do themselves for your controls to work.
- Use that picture to decide between SOC 1, SOC 2 or both.
- GuideWho is who in a SOC 1The service organization, user entities and user auditors, and how a report moves between them.
- GuideSubservice organizations: vendors inside your reportWho counts, how they're monitored, and what the report must say.
- GuideScope & the system boundaryWhat's in, what's carved out, and the CUECs your customers own.
Sources: AICPA SSAE 18, AT-C section 320 (definitions of service organization, user entity and subservice organization); AICPA SOC 2 guide.
Questions about Service organization
Do we need to be large to be a service organization?
No. Size does not matter.
A two-person company that hosts a customer's data is a service organization for that customer. What matters is whether customers rely on your controls.
Is every SaaS company a service organization?
For SOC purposes, usually yes.
If customers put data or processes in your product, your controls affect theirs. Whether they need a SOC 1, a SOC 2 or neither depends on what they rely on you for.
Want this applied to your own systems?
Our team can walk through where this term touches your scope, your contracts and your evidence.