[NoPicklez]

It's generally accepted that a SOC2 report of a SaaS provider covers the controls that are the responsibility of the company to manage.