Does Dropbox have SOC 2?
Yes — Dropbox has SOC 2 Type II, verified against their published documentation.
As of June 10, 2026. Source: vendor documentation ↗. SOC 1, SOC 2, and SOC 3 reports available via the Trust Center; most recent reports cover Oct 2024–Sep 2025.
What SOC 2 actually tells you
SOC 2 is an attestation (not a certification) issued by a CPA firm against the AICPA Trust Services Criteria. A Type I report evaluates control design at a point in time; a Type II report tests whether controls operated effectively over a period, typically 6–12 months — which is why security reviews usually require Type II.
The existence of a report is the start of diligence, not the end: scope matters (which products and criteria were covered), and so do the exceptions noted inside the report.