Consultants and SOC 2 compliance

Anyone have experience with needing SOC 2 compliance to consult with agencies? I've heard instances where people think it's not necessary (as consultants, we're using Salesforce so the audit would be on Salesforce not on us) and instances where people think it is (if we're accessing privileged information audits apply) Note:I only learned the phrase SOC 2 in the last week so very junior to this convo but interested to hear what others' experience has been. Thoughts??  #Salesforce Developer