All SOC tells you is that there is a process being (mostly) followed. Always review the reports for your vendors and follow up on any findings or gaps that show up.

It's surprisingly common for places to be SOC compliant, yet their latest report has half a dozen or more gaps/findings.