SOC 2 Type II and ISO 27001: A Security Checklist for Choosing a Sales Call AI Tool (2027)

Of the sales call AI tools we checked in November 2026, Proshort, Gong, Outreach and Sybill state both SOC 2 Type II and ISO 27001 certification on their own security pages. Avoma, Fireflies, Otter, Fathom and Attention state SOC 2 Type II but not ISO 27001 certification. Certifications are the floor: also check consent, data residency, retention, sub-processors and access.

Disclosure: we build Proshort. Every certification below is recorded as the vendor's own security or trust page stated it when we checked in November 2026. "Not stated" means the page we read does not claim it, not that the vendor lacks it, so ask.

Key takeaways

• SOC 2 Type II is an independent auditor's report on whether a vendor's security controls actually worked over a review period. Type I only checks their design on one date.

• ISO 27001 certifies a vendor's information security management system: how it finds, treats and keeps reviewing security risk.

• Ask for the report and the certificate, not the badge. "Aligned with" or "based on" ISO 27001 is not the same as certified.

• For AI on sales calls, certifications are the floor. Recording consent by region, data residency, retention, sub-processors and who sees what decide whether legal signs off.

• Proshort is SOC 2 Type II and ISO 27001 certified and GDPR compliant; regional data residency and SSO are available on enterprise rollouts.

Which conversation intelligence tools are SOC 2 Type II and ISO 27001 certified?

We read each vendor's own security or trust page and copied what it says. Wording matters, so the table keeps it.

Two patterns stand out heading into 2027. First, ISO/IEC 42001, the AI management system standard, now appears on the pages of Gong, Sybill, Avoma, Fireflies and Winn.ai. Second, the wording varies a lot: "certified," "audited," "aligned with" and "based on" are not interchangeable, and your security team will read them literally.

What is SOC 2 Type II, in plain terms?

SOC 2 is an examination by an independent CPA firm, under the AICPA's framework, of a service provider's controls relevant to security, availability, processing integrity, confidentiality or privacy. The result is a report, usually shared under NDA, not a public certificate.

The type matters. As audit firm A-LIGN explains, a Type I report covers how controls are designed at one point in time, and a Type II report tests whether they operated effectively across a review period. For a tool that records and analyzes your buyers' words, Type II is the one to ask for.

When the report arrives, check five things: the period it covers, which of the five categories are in scope, whether the system description includes the AI and transcription components you will use, any exceptions the auditor found, and the controls the vendor expects you to run on your side.

What is ISO 27001, in plain terms?

ISO/IEC 27001:2022 specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system (ISMS), including how an organization assesses and treats security risk. A certification body audits the vendor against it and issues a certificate.

Ask for the certificate itself and check three things: who issued it, which products and locations its scope covers, and when it expires. A certificate that covers a head office but not the product you are buying does not help you.

SOC 2 vs ISO 27001: what is the difference?

They answer different questions, which is why a security team may ask for both. Neither covers consent law or how a specific AI feature behaves on a call, which is why the checklist below goes further.

What should a security checklist for a sales call AI tool include?

Use these ten questions in your 2026–27 vendor reviews. Each one maps to a real way sales call data can go wrong.

Scope the review to everything the tool will touch, not only recordings. A sales AI tool can reach well beyond the call, as one Proshort customer described it:

"For me, this becomes a very overarching sales AI use case where it is not about call recording. It is about using AI to manage and structure my mailbox, my communications tied to a particular deal." Amit Tomer, VP of Strategic Sales, Aviz Networks (read the Aviz Networks case study)

1. Certifications and the documents behind them. Ask for the current SOC 2 Type II report and the ISO 27001 certificate, and check dates and scope.

2. Recording consent per region. Consent rules differ by country and state. Ask how the tool notifies participants and how it handles regions with stricter rules.

3. Who sees what on the call. If the tool shows prompts during the call, confirm they are visible only to the rep and that the buyer sees only the standard recording notice.

4. Data residency. Ask where recordings and transcripts are stored and whether you can choose a region, and on which plan.

5. Encryption. Ask for the algorithm at rest (for example AES-256) and the protocol in transit, and who manages the keys. Gong, for example, lists bring-your-own-key encryption.

6. Retention and deletion. Ask for the default retention period, whether you can shorten it, and what happens at contract end. Gong's page, for example, states a default of up to three years or the contract term, whichever is shorter, with deletion 30 days after termination.

7. Sub-processors, including AI model providers. Under GDPR Article 28(2), a processor needs the controller's written authorisation to engage sub-processors and must say in advance when it adds or replaces one. Ask for the list and how you are notified.

8. Use of your data for model training. Ask in writing whether your calls are used to train models, and whether that can be switched off.

9. Access control. Ask about SSO (SAML), user provisioning (SCIM) and role-based access, and which plans include them.

10. AI governance. If your company has an AI policy, ask whether the vendor states ISO/IEC 42001 and how it tests AI output before release.

How do you verify a vendor's security claims?

1. Read the trust or security page and copy the exact wording, as in the table above.

2. Request the SOC 2 Type II report under NDA and check the review period ends recently.

3. Request the ISO 27001 certificate and check issuer, scope and expiry.

4. Send your security questionnaire, including the ten questions above.

5. Run one test call and see exactly what the buyer side sees and hears.

6. Clear security before the pilot, not after, so a pilot that works can expand without a second review.

Where Proshort fits (and where it does not)

Per Proshort's security page, Proshort is SOC 2 Type II and ISO 27001 certified, GDPR compliant, hosted on Google Cloud Platform with 256-bit AES encryption, and handles recording consent per region. Enterprise rollouts add regional data residency, SSO / SAML and role-based access. The page lists the latest certification audits as May 2026; ask us, as you would any vendor, for the current report and its period.

On the call, Aria Live puts sourced answers on the rep's screen and only the rep sees them. The buyer sees a normal meeting: no prompts, no pop-ups, nothing to install, just the standard recording notice. That matters to security reviewers who ask what an external participant is exposed to.

Where it does not fit: if your security team requires frameworks beyond SOC 2 and ISO 27001 as stated items, such as ISO 27701, ISO 42001, PCI DSS or CSA STAR, Gong and Sybill list more of them on their pages. Proshort's security page does not list HIPAA; Sybill, Fireflies, Fathom and Attention state it, so healthcare teams that need a BAA should check those terms directly. And if you need data residency or SSO on a small team plan, note that Proshort offers them on enterprise rollouts.

Frequently asked questions

Is SOC 2 Type II better than ISO 27001?

Neither replaces the other. SOC 2 Type II is an auditor's report that specific controls worked over a review period. ISO 27001 certifies that the vendor runs an information security management system that meets the standard. Enterprise buyers often ask for both, then add questions on consent, residency and retention.

Does "SOC 2 compliant" mean the vendor has a SOC 2 Type II report?

Not necessarily. "Compliant" can mean a Type I report, a Type II report, or an audit in progress. Ask for the report itself, check whether it is Type II, and confirm the review period ended recently. The same applies to ISO 27001: "aligned with" or "based on" the framework is not a certification.

Which sales call AI tools state both SOC 2 Type II and ISO 27001?

On their own security pages in November 2026, Proshort, Gong, Outreach and Sybill state both. Winn.ai lists SOC 2 and ISO 27001 without naming the SOC 2 type on the page we could read. Avoma, Fireflies, Otter, Fathom and Attention state SOC 2 Type II but not ISO 27001 certification.

Is Gong SOC 2 Type II and ISO 27001 certified?

Yes, per its own page. Gong's security page lists SOC 2 Type II and ISO/IEC 27001:2022, plus ISO/IEC 27017, 27018, 27701 and 42001:2023, PCI DSS, the CSA STAR Registry and the EU-U.S. Data Privacy Framework. It states a default retention of up to three years or the contract term, whichever is shorter.

Is Proshort SOC 2 Type II and ISO 27001 certified?

Yes. Proshort is SOC 2 Type II and ISO 27001 certified and GDPR compliant. It is hosted on Google Cloud Platform with 256-bit AES encryption and handles recording consent per region. Regional data residency, SSO / SAML and role-based access are available on enterprise rollouts.

Do buyers need to consent when an AI tool is on a sales call?

Recording consent rules vary by country and state, so check with your legal team for the regions you sell into. Choose a tool that handles consent per region and notifies participants. With Proshort's Aria, the buyer sees the standard recording notice, while the live prompts stay on the rep's screen only.

If your security team is reviewing AI for sales calls, book a Proshort demo and ask for our security documentation in the same meeting.