SOC 2 compliance strongly recommends multi-factor authentication to meet security CC6 requirements, and while not explicitly mandated, auditors expect it. Vapi supports SOC 2 Type II compliance and enables MFA through voice biometrics or traditional methods to help meet these standards..