SOC 2 Type 2 Certification Just Became Berry Street's Sharpest Sales Pitch

What Berry Street's SOC 2 Type 2 Certification Actually Proves#

The fox does not brag about the burrow, it lets the tracks tell the truth. Berry Street, the nutrition-therapy platform that connects patients to registered dietitians, did something close to that on 20 August 2026, when it announced SOC 2 Type 2 certification and let a stranger's signature do the talking. Johanson Group LLP examined the Security criterion drawn from the AICPA's Trust Services Criteria over a three-month period ending June 2026, according to Berry Street's own announcement. Completed with no exceptions noted: three careful, unglamorous words that carry more weight than any headline.

Berry Street's co-founder and CEO, Noah Kotlove, framed the reasoning plainly: "Nutrition care only works when people feel safe being honest about their health." The platform already serves more than 200,000 patients through 1,250-plus insurance plans, per Berry Street's own site, which means every clean claim, every diagnosis and every lab value has somewhere private to go. Diagnoses, lab results, medication records and behavioural health detail all sit inside the protected health information that HIPAA's Privacy Rule obliges a covered entity to guard, minimum-necessary disclosure, documented access, the full administrative and technical stack. A SOC 2 Type 2 report is the paperwork that says the door actually locks.

Read as a marketing event rather than a filing cabinet update, the announcement is doing exactly what Berry Street says it is doing: opening doors to payer, health-system and enterprise partnerships that would not touch a vendor without one. That is the story folkfox keeps finding across regulated sectors, and it is why this piece treats SOC 2 Type 2 as sales enablement first and a compliance checkbox second.

Type 1 Promises, SOC 2 Type 2 Proves#

Most buyers use the two labels loosely, and most vendors let them. A SOC 2 Type I report checks whether the right controls are designed and documented on a single day; a SOC 2 Type 2 report checks whether those same controls actually held up while nobody was watching. Imperva's own SOC 2 explainer puts it cleanly: Type I answers whether a vendor's system design is suitable, Type II details how effectively it operates in practice, typically across a run of months rather than one afternoon.

How many months varies. A-LIGN, one of the AICPA's own accredited audit firms documents Type II periods running three to twelve months, and notes that this deeper report is "increasingly what customers require." a broader survey of SOC reporting puts the typical window at nine to twelve. Berry Street's three-month period sits at the short end of that range, still a genuine observation window, not a snapshot, and still a real gap between a policy on a shelf and a practice proven in production.

This is the part smaller teams skip past, and it is the whole point of SOC 2 Type 2. Writing a policy takes an afternoon. Proving the policy was followed, every week, for three to twelve months, across every named control, takes a working security programme, screenshots, tickets, access logs, the unglamorous evidence trail an auditor actually samples. Microsoft's own audit documentation is instructive here: Office 365 runs a rolling twelve-month run window, refreshed with quarterly bridge letters in the gaps, because a Type 2 opinion has an expiry date the moment the observation window closes. That is the real work, and no amount of tidy policy paperwork substitutes for it.

Read the slope the way you would read a fox's trail across frost: the direction matters more than the exact stride. Every buyer segment is asking earlier and asking harder, and the segment asking hardest, health and payer procurement, is precisely where Berry Street just planted its flag.

SOC 2 vs ISO 27001: attestation versus certification#

Buyers weighing SOC 2 vs ISO 27001 often assume the two are the same proof wearing different labels. They are not. SOC 2 is an audit that produces an attestation report, carried out by a licensed CPA firm; ISO 27001 is a certification, issued by an accredited ISO 27001 certification body, according to A-LIGN's own comparison of the two frameworks.

The renewal clocks differ too: a SOC 2 report, Type I or Type II, is considered valid for twelve months from its report date, while an ISO 27001 certificate runs three years, propped up by annual surveillance audits in between. Reach differs as well, SOC 2 was built by the AICPA and stays the default ask across North America, where Berry Street operates, while ISO 27001 is the standard international buyers reach for first.

Neither substitutes for the other: a payer asking for a SOC 2 Type 2 report will not accept an ISO 27001 certificate instead, and a vendor selling into both US and European enterprise procurement eventually needs both, not a choice between them.

Why B2B Buyers Now Expect a SOC 2 Type 2 Report Before Talking Numbers#

Enterprise procurement teams stopped taking a vendor's word for its own security years ago. Imperva notes that SOC 2 has become a baseline expectation for security-conscious buyers evaluating SaaS and cloud providers, a competitive differentiator precisely because it is not legally mandated. Nobody has to ask for it. Enough buyers do anyway that not having one is its own answer. Even the hyperscalers play this game seriously: AWS's own SOC compliance FAQ issues its own SOC 2 report twice a year, and gates access behind a signed non-disclosure agreement rather than a marketing page, because the report itself is the sales asset, not the announcement about it.

Vendors have noticed. Vanta positions its own SOC 2 tooling around exactly this buyer behaviour, building a public trust page so a prospect can read the report before a sales call even starts. That is a vendor's own marketing framing, worth repeating honestly rather than as a measured benchmark: it describes an incentive, not a proven percentage.

That is a practitioner mid-prowl, tools connected, policies drafted, tests green, and still asking the honest question in the r/soc2 thread. The answer, gently, is that a Type I report can absolutely come back clean on exactly that evidence, because Type I only checks whether the controls are designed and documented today. A SOC 2 Type 2 report asks the harder question: did they hold, week after week, for months. Green tests on day one are the starting scent, not the finished trail.

What Actually Blocks Small Teams From SOC 2 Type 2#

Every team that has gone through this will name the same handful of snags, and none of them are the paperwork. The paperwork is the easy part; the calendar is the hard part.

Penetration testing alone is a recurring, real cost most first-time teams underbudget: it sits outside the audit fee and has its own supplier, its own scheduling and its own report to fold into the evidence pack. Auditor availability is the second quiet tax, good AICPA-accredited firms book out months ahead, so a team that starts shopping for an auditor after the observation window opens has already lost time it cannot buy back.

The gap the Reddit thread actually shows#

The practitioner-practical gap is the one worth naming out loud, because it is the one automated compliance tooling cannot close on its own. Connecting GitHub, Linear, AWS and Fly to a platform like Vanta proves the controls exist and the tests currently pass. It does not, on its own, prove three to twelve months of consistent operation, which is the entire difference between a Type I promise and a SOC 2 Type 2 proof. Small teams that budget for the calendar, not just the checklist, are the ones that clear it without a scramble.

Turning SOC 2 Type 2 Into a Marketing Asset, Not Just a Compliance Line#

Here is where most compliance teams stop and most marketing teams should start. Berry Street did not bury its SOC 2 Type 2 news in a trust-centre footnote, it put a named auditor, a named criterion and a named CEO quote in a press release, and tied every sentence back to the partnerships it unlocks. That is content marketing done properly: specific claims, sourced facts, nothing a generative summary or a sceptical procurement officer has to take on faith.

The honest version of this pitch matters more than the polished one. Selling SOC 2 Type 2 as a vague trust signal invites the same scepticism as any other superlative; selling it as "security operated correctly for a named period, examined by a named firm, against a named criterion" is the kind of claim a buyer's own security team can verify in minutes. That distinction is brand strategy work as much as it is compliance work, and it is exactly the discipline folkfox brings to SEO and GEO for regulated clients across DORA-scoped operational resilience work and beyond.

None of this happens in isolation. CMMC's own marking mess already showed how a single missed deadline reframes an entire compliance narrative, and NIS2's referral to the Court of Justice made the same point about cross-border enforcement: the frameworks keep multiplying, and the vendors that turn each one into a plain, provable sentence are the vendors that keep closing enterprise deals while their competitors are still drafting policy. A SOC 2 Type 2 report, told honestly, is one more sentence procurement can check without picking up the phone.

The fox that survives the winter is not the boldest one, it is the one that leaves the clearest trail back to a den worth trusting. Berry Street's audit is that trail. What a growth team does with it next, plain language, sourced claims, a sentence procurement can verify, decides whether the certification becomes a sales asset or stays a filing-cabinet footnote.

Frequently asked questions#