Do collection agencies need a SOC 2 report from an agent matching vendor?
Larger collection agencies usually ask for a SOC 2 report before any account data moves, often because their own clients audit the agency’s vendors. BestPair holds SOC 2 Type 1, and a SOC 2 Type 2 audit is under way. The data BestPair receives is pseudonymised only: account IDs, account details and call and payment history, with no consumer names or contact details. So the review has less to cover than it would for a vendor that holds contact details.
New to BestPair? See what it is and how it works
Why agencies ask for SOC 2
A collection agency works accounts for creditors and debt owners, and many of them audit the agency’s vendors as well as the agency. Any vendor that receives account data falls inside that audit. A SOC 2 report is the document vendor reviewers recognise: an independent auditor’s report on a company’s security controls.
Some agencies ask for it on the first call. Others only meet the question at their annual client audit, which is a worse time to find a gap. Settle it before the first file moves.
What BestPair holds: SOC 2 Type 1
BestPair holds SOC 2 Type 1 (report issued May 2026, covering Security, Availability and Confidentiality, available under NDA). A SOC 2 Type 2 audit is under way. There are two kinds of SOC 2 report, and the difference matters to reviewers:
| Report | What the auditor checks |
|---|---|
| SOC 2 Type 1 | That the security controls are designed properly and in place, at a point in time |
| SOC 2 Type 2 | That the same controls operated as designed over a period, usually several months |
What a security review usually asks
Vendor questionnaires differ, but the first questions are about the data and where it goes. Here is how BestPair answers them:
| Question | BestPair’s answer |
|---|---|
| What data do you receive? | Pseudonymised only: account IDs, account details (balance, days delinquent, placement date, consumer age band, state and ZIP code) and call and payment history keyed to collector IDs, plus data about your own collectors (agent ID, start date, results). No consumer names, Social Security numbers, phone numbers, email or street addresses, or bank or card details. |
| Where is it processed? | Off-site, by BestPair, on AWS in the United States. The matching does not run inside your environment. |
| How does it arrive? | By encrypted SFTP to a folder BestPair provides, never by email. |
| How is it encrypted? | TLS 1.2 or higher and SFTP in transit; AES-256 at rest. |
| Who can reach it? | Only named BestPair staff who need it. The founder and R&D team are in Australia and may access it remotely from company-managed devices; the data itself is stored and processed only in the United States. |
| How long is it kept? | For the engagement only. Deleted within 30 days after it ends, with written confirmation; backups roll off within 90 days. |
| What if there is an incident? | You are notified without undue delay, and within 72 hours of a confirmed incident affecting your data. |
| Who contacts consumers? | Your collectors. BestPair never dials, calls, texts or contacts anyone. |
| What if a file contains personal data? | BestPair deletes it and asks for a resend. |
| Independent assurance? | SOC 2 Type 1. A SOC 2 Type 2 audit is under way. |
On request, before any data moves: the SOC 2 Type 1 report (under NDA), BestPair’s Security Overview, the Data Processing Addendum and, for healthcare accounts, a Business Associate Agreement, and a completed SIG Lite or CAIQ questionnaire. Anything else your reviewer asks is answered in your own questionnaire.
How pseudonymised data shrinks the review
Vendor risk reviews usually start by classifying the data the vendor will hold, and the scope follows from that. A vendor holding consumer names, phone numbers or Social Security numbers draws the full set of questions on how that data is protected. BestPair never asks for any of it. The data is pseudonymised only: account IDs are your own, so BestPair cannot tell who a consumer is, and the link between an account ID and a person stays in your systems. What BestPair receives and what it never asks for.
The review is also about a data feed rather than software. The matching runs off-site, so there is no vendor software to host inside your network, and your dialer’s contact rules stay as they are. What your IT team does.
Two things still need care. Account and payment history is confidential business information for you and your clients. No separate NDA is needed to start: the Order Form and the Data Processing Addendum cover confidentiality. And a client contract can set its own vendor requirements: read yours before the fit call.
Common follow-up questions
Is SOC 2 Type 1 enough for our review?
That depends on what your clients’ audits require. Type 1 shows the controls are designed and in place; Type 2 tests whether they operated over a period. A SOC 2 Type 2 audit is under way. If your client contracts require Type 2 from every vendor that touches account data, raise it on the fit call so it is settled first.
Is BestPair PCI DSS compliant?
BestPair receives no card data and takes no payments, so card details stay in your payment systems.
When should our security review start?
Before any data moves. The review usually decides the date the first file arrives, so starting it early keeps it off the critical path. No separate NDA is needed to start: the Order Form and the Data Processing Addendum cover confidentiality.
What it could mean on your floor
Two minutes
Watch the explainer
What your dialer does with the next account, what pairing changes, and what the Floor Assessment measures. With captions.
Watch the videoYour floor
Try the calculator
Four numbers off your dialer and collections reports give an illustrative figure for your floor. It is at best informed guesswork until your own history is measured.
Open the calculatorA live test
Read the case study
170,000 telecom accounts split at random before the first call, and how the result was counted.
Read it
Would it be a bad idea to spend 45 minutes finding out?
If your shop does not qualify, you will hear it on the call, not after you have paid for a report.
Book a 45-minute fit call