Condado Is SOC 2 Type II Compliant — What It Means for the Partners Evaluating Us

Condado is SOC 2 Type II compliant, covering the Security trust services criteria. This reflects an independent audit performed by Advantage Partners, covering the period of January 13, 2026 through April 13, 2026.

What SOC 2 Type II (Security) Actually Means

A SOC 2 report is a formal attestation, issued by a licensed CPA firm, describing whether a company's controls were tested over a sustained period of time and what the auditor found. 

A Type I report only confirms that controls were designed appropriately at a single point in time. A Type II report goes further:it examines how those controls performed across months of real-world activity — in Condado's case, a three-month audit window.

The Security criteria specifically covers how a company protects systems and data against unauthorized access, both physical and logical. In practice, that means an auditor independently examined things like:

• How access to systems and data is provisioned, reviewed, and revoked
• How changes to production systems are approved and tracked
• How systems are monitored for unusual or unauthorized activity
• How the company responds to and documents security incidents
• How risk from third-party tools and vendors is assessed and managed

These aren't policies on paper — a Type II reportooks at how these controls actually performed during the audit window.

Why This Matters for CX and CCaaS Buyers

If you're evaluating a partner to help design, implement, or manage your contact center and CRM technology, you're not just buying software recommendations. You're granting that partner real, often broad, access to your environment — customer data, call recordings, payment information, and live system integrations across your CCaaS and CRM stack.

That access is exactly why compliance posture belongs in the same conversation as technical capability. A SOC 2 Type II report gives buyers something more concrete than a vendor's word:independent, third-party examination of access controls, change management, and day-to-day security practices. 

For teams evaluating CX and CCaaS implementation partners (particularly in regulated industries like financial services and healthcare), that evidence can be the difference between a security review that moves quickly and one that stalls for weeks.

Keeping the Report Current

A SOC 2 Type II report reflects a specific audit period, not a permanent state — the underlying controls need to keep operating as designed after the report is issued for the compliance to mean anything ongoing. Condado treats this as a continuing operational commitment rather than a one-time milestone, and will keep the trust center updated as that work continues.

How to Request the Report

Condado's SOC 2 Type II report (Security) is available to customers and partners on request through our trust center at trust.condado.com. Access is reviewed on a per-request basis, so reach out to your Condado contact or request access directly.