Yes. What you promise customers can matter to the examination. Those promises are not limited to signed contracts. Relevant public statements can also form part of your service commitments.
That does not make every marketing sentence an audit control. It does mean your security page should describe the service you actually provide.
Check the claims people could rely on
Start with specific statements rather than slogans:
- “Our team monitors alerts 24/7.”
- “Customer data is deleted within 30 days.”
- “All access requires multifactor authentication.”
For each claim, ask the person who runs the process whether it is accurate. An alerting tool that runs overnight is not the same as a person reviewing alerts overnight. A deletion job for the main database may not describe what happens to backups.
Keep the review small
A short list is enough to begin:
- The claim and where it appears.
- Who checked it.
- What supports it or needs changing.
Include your trust page and standard sales answers. Do not create a second giant questionnaire.
Fix the mismatch, not just the wording
If the statement is wrong, involve the responsible business owner. Decide whether the service needs to change or the statement needs correction. Have legal counsel review material commitments when needed.
Editing a web page does not erase an existing customer agreement. Do not quietly change the copy and assume that resolves what customers were already promised.
Give the auditor accurate information about the relevant commitments and any gaps. Before the next website refresh, add a quick owner review for new security claims.
Source
AICPA Trust Services Criteria, paragraphs .18–.19, connect SOC 2 objectives with service commitments and system requirements. Public statements are among the places commitments can appear.