In general, most companies want to scope SOX as narrowly as possible. So if you can, only things that your auditors think will affect revenue reporting.

Querying ads performance data? Sure, we'll SOXify it. Querying user accounts writ large? "Meh, our engineers need to be productive."