SOC 219 April 2026 6 min read

SOC 2 Confidentiality Criteria: What C1.1–C1.2 Require

SOC 2 Confidentiality criteria C1.1 and C1.2 explained — who needs them, what controls are required, and what evidence auditors expect to see.

Key Takeaways

Confidentiality has two criteria: C1.1 (identifying and maintaining confidential information) and C1.2 (disposing of confidential information).
Confidentiality protects data that companies designate as confidential — distinct from Privacy, which protects individuals' personal data.
C1.2 (data disposal) is commonly excepted because companies implement collection controls but not deletion controls.
Encryption-at-rest and encryption-in-transit are the primary technical controls for C1.1.
Data retention and deletion workflows must be documented and tested to satisfy C1.2.

In this guide

Who Needs the Confidentiality TSC
C1.1: Identifying and Protecting Confidential Information
C1.2: Disposing of Confidential Information
Evidence Required for Confidentiality
Confidentiality TSC vs Privacy TSC: The Distinction

Who Needs the Confidentiality TSC

The Confidentiality TSC is relevant when your service commitments include protecting information that customers designate as confidential. Common use cases: legal tech platforms storing client contracts and case files; financial data platforms handling non-public financial information; HR systems storing compensation data and performance reviews; IP management platforms storing trade secrets and proprietary research.

The trigger is typically customer contract language. If your MSA or DPA includes a provision that your company will treat customer data as confidential and implement appropriate protections, you have a service commitment that the Confidentiality TSC evaluates. Enterprise customers in regulated industries often require Confidentiality in scope.

Confidentiality is the second most commonly added TSC after Availability. Like Availability, it adds $3,000–$8,000 to auditor fees and requires implementing specific controls. The incremental burden is low for companies that already have encryption-at-rest and data lifecycle management — primarily they need to formalize data classification and disposal procedures.

C1.1: Identifying and Protecting Confidential Information

C1.1 requires that the entity identifies and maintains confidential information to meet the entity's objectives related to confidentiality. This breaks into two requirements: identification (knowing what data is confidential and labeling it appropriately) and protection (ensuring that labeled confidential data has appropriate access controls and encryption).

Data classification is the operational backbone of C1.1. You need a written data classification policy that defines what constitutes confidential data (versus public or internal data), and a process for applying that classification to data as it enters your system. For SaaS platforms, classification is often implicit in the data type — all data uploaded by customers to a legal document repository is classified as confidential by default.

Protection controls for confidential data include: encryption-at-rest using AES-256 or equivalent for confidential data stores; encryption-in-transit using TLS 1.2+ for all data transmission; access controls limiting confidential data to authorized users; audit logging of all access to confidential data; and DLP (data loss prevention) controls preventing unauthorized export.

C1.2: Disposing of Confidential Information

C1.2 requires that confidential information is disposed of when no longer needed. This criterion addresses the full data lifecycle — from collection through retention to deletion. The requirement has two dimensions: (1) you have a retention policy defining how long different data types are kept, and (2) you have a disposal process that securely deletes or destroys confidential information when the retention period expires or when a customer requests deletion.

For cloud-hosted companies, secure disposal means cryptographic erasure — overwriting or deleting encryption keys for data stored with customer-managed keys, or using AWS's certified data destruction process for managed storage. For physical media, a certificate of destruction from a certified disposal vendor is required.

Customer off-boarding is the most common trigger for C1.2 evidence. When a customer terminates their contract, you must have a defined process for deleting their data within a committed timeframe, notifying the customer of completion, and retaining evidence of the deletion. Many companies have off-boarding processes that handle account access but neglect the data deletion step.

Evidence Required for Confidentiality

For C1.1: data classification policy; encryption-at-rest configuration for databases and file storage (KMS key configuration, S3 bucket encryption settings); encryption-in-transit configuration (TLS certificate configuration, HSTS headers); access control configuration showing confidential data stores are restricted to authorized roles; audit log configuration showing access to confidential data is logged.

For C1.2: data retention policy with defined retention periods by data type; automated data deletion workflow documentation or manual deletion procedure; evidence of customer data deletion upon off-boarding (deletion confirmation, ticket records); backup deletion procedures ensuring confidential data is removed from backups after retention period.

Confidentiality TSC vs Privacy TSC: The Distinction

The Confidentiality TSC and Privacy TSC address different types of information. Confidentiality protects information that organizations (your customers) designate as confidential — trade secrets, financial data, legal documents, proprietary research. Privacy protects personal information belonging to individuals — names, email addresses, behavioral data, health records.

A legal tech platform storing client contracts needs Confidentiality because the contracts are confidential business information. The same platform likely also needs Privacy if it stores the names and contact information of the individuals associated with those contracts.

Some companies add both; most add one or the other based on their primary customer concern. Legal, financial, and IP-focused platforms typically lead with Confidentiality. Consumer-facing or employee-data-processing platforms typically lead with Privacy. Many enterprise procurement teams ask specifically which TSC is in scope — knowing the difference matters for your sales conversations.

Frequently Asked Questions

Is TLS enough to satisfy C1.1?

TLS satisfies the encryption-in-transit component of C1.1. You also need encryption-at-rest for confidential data stores. TLS alone, without encryption-at-rest, is insufficient because data at rest in unencrypted databases is accessible to anyone with database access — which violates the confidentiality protection requirement for data that is not in transit.

What is a data retention policy for SOC 2 purposes?

A data retention policy specifies how long each category of data is kept, who owns the decision, the legal and business justification for the retention period, and the process for deleting data after the retention period expires. For SOC 2 Confidentiality, the policy must address confidential customer data specifically and define the retention period for that data class. The policy should be aligned with your customer contracts — if you promise 30-day deletion upon termination, the policy must reflect that.

Do we need to delete data from backups for C1.2?

Yes — C1.2 requires disposal from all storage, including backups. The practical approach for most companies is a defined backup retention period after which backups are automatically deleted. If backups contain confidential data, they must be included in the disposal process. Companies using AWS Backup can configure lifecycle policies to automatically expire backup copies; the configuration and automatic expiry records serve as C1.2 evidence.

Can customer contracts define what is confidential rather than us classifying it?

Yes — this is common practice. Your MSA or DPA can include a provision stating that all data customers upload or share through the service is treated as confidential. This contractual definition satisfies the identification component of C1.1. The protection and disposal obligations then apply to all customer data without requiring a technical classification system.

Does the Confidentiality TSC apply to employee data?

The Confidentiality TSC covers data that you commit to protect as confidential in your service agreements with customers — it primarily covers customer-uploaded or customer-shared data. Employee data is typically addressed under the Privacy TSC (if added to scope) or through HR policies referenced in CC1. Employee compensation, performance reviews, and health information held by your HR systems are generally out of scope for Confidentiality TSC unless those systems are explicitly in your SOC 2 scope.