"SOC 2 certified" is not a report
I still see proposals that say the vendor is "SOC 2 compliant" or "SOC 2 certified."
Those are marketing words. A Type II report exists or it does not. You read it under NDA. You look at the period, the trust services categories, and whether exceptions were noted.
CPA firms are covered financial institutions under the FTC Safeguards Rule. You have to oversee service providers. The FTC's Safeguards Rule page is not optional paperwork.
What I ask for before the first client moves
- The SOC 2 Type II report under NDA
- A confidentiality agreement that actually binds the provider
- Named review: who signs off, and whether a licensed CPA is in that chain
- A sample package, not a slide about security
- A way to test on one live file before a volume contract
That list is the same diligence I use in how to choose a white-label bookkeeping partner. Journal of Accountancy coverage of outsourcing and professional liability walks through why confidentiality does not disappear when production leaves your office.
Reconstruction files are not an exception
Catch-up and unfiled years still contain client data. Bank statements, SSNs on payroll, loan documents. The Safeguards Rule does not pause because the books are behind.
If the file is historical, use book reconstruction for tax professionals or tax deadline reconstruction. The security bar is the same as monthly delivery. For CPA Firms is the white-label overview.
What stays with the firm
You still own the client. You still review the package. You still decide what goes out the door.
White-label means the client never sees the vendor. It does not mean you skip vendor diligence. Should you tell your clients you outsource bookkeeping is the disclosure conversation. This post is the security conversation.
Look at sample deliverables and how it works before you send data. Then run a free test client if monthly delivery is the fit.
Ask for the report. Then test the work.
Schedule a conversation if you want to walk the diligence checklist, or start at For CPA Firms.