- SOC 2 is an attestation report from an independent CPA firm against the AICPA’s Trust Services Criteria. ISO 27001 is a certification of an information security management system.
- A SOC 2 Type II report shows controls worked over a period of time, not just on one day. That is the version to ask for.
- ISO/IEC 27001:2022 lists 93 Annex A controls across four themes: organizational, people, physical and technological.
- Neither badge tells you which of your data a vendor touches. Ask that first.
Every OTA procurement process now has a security questionnaire. And every questionnaire asks the same two things: “Are you SOC 2 compliant?” and “Are you ISO 27001 certified?”
Most vendors answer yes. Most buyers tick the box and move on.
That is a mistake. The two standards prove different things, a “yes” can mean very different levels of assurance, and neither one answers the question that matters most: what data will this vendor actually hold?
This guide explains SOC 2 and ISO 27001 in plain terms, shows how they apply to hotel data, and gives you the questions worth asking.
Why this matters more in travel
Travel companies hold exactly the data attackers want. Names, passport numbers, payment details, travel dates and home addresses, often in the same record.
The Marriott case is the one everyone in hotels remembers. An intrusion into a Starwood server in 2014 went undetected, and Marriott inherited it when it bought Starwood in 2016. According to Cybersecurity Dive, at least 339 million guest records were affected, and the UK Information Commissioner’s Office fined Marriott £18.4 million under GDPR. The regulator said Marriott had not done enough due diligence when it acquired Starwood.
The lesson for OTAs is not about hotels. It is about third parties. The data you share with a vendor is still your responsibility. Certifications are one of the few tools you have to check that vendor before something goes wrong.
You can outsource a service. You cannot outsource the responsibility for the data you hand over with it.
SOC 2 in plain terms
SOC 2 is a framework created by the American Institute of Certified Public Accountants (AICPA). A licensed CPA firm examines a company’s controls and issues a report with its opinion. Only a licensed CPA or CPA firm can perform the audit.
The examination is measured against the AICPA’s Trust Services Criteria. There are five categories:
- Security: protection against unauthorized access. This one is mandatory.
- Availability: the system is available as committed.
- Processing integrity: processing is complete, accurate and timely.
- Confidentiality: confidential information is protected.
- Privacy: personal information is handled properly.
Only security is required in every report. The other four are scoped in based on what the vendor has committed to its customers. So two vendors can both be “SOC 2 compliant” and cover very different ground.
Type I versus Type II
This is the distinction that matters most.
- A Type I report checks whether controls are suitably designed, at a point in time.
- A Type II report checks the design and whether the controls actually operated effectively over a review period.
Type I tells you the vendor wrote good rules. Type II tells you it followed them. For any vendor that will touch your systems or data, ask for Type II.
ISO 27001 in plain terms
ISO/IEC 27001 is an international standard for an information security management system, or ISMS. It is less about a list of technical settings and more about how a company manages security as an ongoing process: risk assessment, policies, ownership and continual improvement.
Companies are certified by an independent certification body and kept on the hook through regular surveillance audits.
The 2022 version of the standard includes an Annex A with 93 controls across four themes:
| Theme | Controls | Examples |
|---|---|---|
| Organizational | 37 | Policies, supplier security, incident management |
| People | 8 | Screening, awareness training, confidentiality agreements |
| Physical | 14 | Secure areas, equipment security |
| Technological | 34 | Access control, encryption, logging, secure development |
A certified company has to state which controls apply to it and justify any it excludes. That document, the Statement of Applicability, is worth asking for.
SOC 2 vs ISO 27001: the short comparison
| SOC 2 | ISO 27001 | |
|---|---|---|
| What it is | An attestation report | A certification |
| Who issues it | An independent CPA firm | An independent certification body |
| Measured against | AICPA Trust Services Criteria | ISO/IEC 27001 requirements and Annex A |
| What you receive | A detailed report, usually under NDA | A certificate, plus scope and Statement of Applicability on request |
| Strongest at showing | That specific controls worked over time (Type II) | That security is managed as a system across the company |
| Most common with | North American buyers | European and global buyers |
They overlap a lot. They are not substitutes. A vendor with both gives you evidence of controls that work and a system that keeps them working.
What hotel data a vendor actually touches
This is the question most questionnaires skip. Different travel vendors handle very different data, and the risk follows the data.
| Data type | Examples | Sensitivity |
|---|---|---|
| Static hotel content | Names, addresses, amenities, room descriptions, images | Low on its own, but commercially valuable |
| Supplier mappings and codes | Your supplier relationships and catalog structure | Commercially sensitive |
| Rates and availability | Contracted and dynamic rates | Commercially sensitive |
| Booking data | Guest names, dates, contact details | Personal data, regulated |
| Payment and identity data | Cards, passport numbers | Highly sensitive, heavily regulated |
A hotel mapping vendor mostly handles the first three rows. A booking engine or payment provider handles the last two. The certifications you require should match the rows the vendor touches.
Do not forget the middle rows. Your supplier list, catalog structure and rates are competitive information. A leak there will not trigger a GDPR fine, but it can hurt you just as much.
Common mistakes in vendor security reviews
Most review failures are not about missing badges. They are about reading the badge and stopping there.
Accepting a logo instead of a report
A SOC 2 logo on a website is not evidence. The report is. It describes the system, the controls tested and any exceptions the auditor found. Read the exceptions section first.
Ignoring scope
An ISO 27001 certificate may cover one product, one office or one data centre. If the service you are buying sits outside that scope, the certificate tells you little about it.
Treating it as a one-time check
Reports and certificates have dates. Ask for the current ones at renewal, not just at signing. A vendor that let its certification lapse will rarely volunteer the fact.
Forgetting the vendor’s vendors
Your mapping vendor runs on cloud infrastructure and other services. Ask how it reviews them. The Marriott case is a reminder that the weak point is often a system someone else built.
Questions to ask any hotel data vendor
- Which of our data will you store, and where? Get a list, not a sentence.
- Is your SOC 2 report Type I or Type II? Ask for Type II, and ask which Trust Services Criteria are in scope.
- What does your ISO 27001 certificate cover? Check that the scope includes the service you are buying, not just one office.
- Can we see the report and the Statement of Applicability? Under NDA is normal. A refusal is a signal.
- Which subprocessors and cloud providers do you use? Your data’s security is only as strong as theirs.
- How do you separate our data from other customers’ data?
- What is your incident notification process and timeline?
- What happens to our data when the contract ends?
Good vendors answer these quickly, because they have been asked before.
How Vervotech approaches it
Vervotech is SOC 2 Type II compliant and ISO 27001 certified, following an independent third-party audit. We map hotel and room content from 400+ suppliers for more than 1,000 travel portals, which means we handle our customers’ catalog structure and supplier relationships every day. We treat that as sensitive data, because it is.
If you are running a security review, we will walk your team through scope, controls and data handling in one call.
Get our SOC 2 Type II and ISO 27001 details and a walk-through of how we handle your data.
Frequently asked questions
What is the difference between SOC 2 and ISO 27001?
SOC 2 is an attestation report issued by an independent CPA firm against the AICPA’s Trust Services Criteria. ISO 27001 is a certification, issued by an independent certification body, that a company runs an information security management system meeting the ISO/IEC 27001 standard.
Is SOC 2 Type II better than Type I?
For vendor due diligence, yes. A Type I report checks that controls are suitably designed at a point in time. A Type II report checks that the controls operated effectively over a review period.
How many controls are in ISO 27001:2022 Annex A?
ISO/IEC 27001:2022 Annex A contains 93 controls across four themes: 37 organizational, 8 people, 14 physical and 34 technological.
Does an OTA need its hotel mapping vendor to be SOC 2 or ISO 27001 certified?
It is strongly recommended. A mapping vendor handles your catalog structure, supplier relationships and often rate data, which are commercially sensitive. Certifications give independent evidence that this data is protected.
Is Vervotech SOC 2 and ISO 27001 certified?
Yes. Vervotech is SOC 2 Type II compliant and ISO 27001 certified, following an independent third-party audit.
