Author
Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
SOC 2 is an attestation report with an opinion, a period and an auditor. Nobody issues a certificate. What the phrase hides, why it spreads, and the four facts to ask for instead.
Solomon Amos · 15 Sep 2026 · 9 min read
Type I says controls were designed properly on one date. Type II says they operated over a period with sampled evidence and listed exceptions. Which to accept, when, and what to ask.
Solomon Amos · 14 Sep 2026 · 10 min read
A bridge letter covers the gap between a SOC report period end and the next report. It is a management statement, not an audit. What it must contain, the 90-day norm, and where it stops.
Solomon Amos · 12 Sep 2026 · 9 min read
A section-by-section reading order for buyers: the opinion, Type and period, criteria in scope, carve-outs, exceptions and the controls you must run yourself.
Solomon Amos · 11 Sep 2026 · 11 min read
Vanta, Drata and SafeBase trust centres all look alike. What each section actually proves, which badges are claims, what freshness signals matter, and how to get the facts out without requesting access.
Solomon Amos · 10 Sep 2026 · 10 min read
HIPAA has no certification. The business associate agreement is the artefact. The ten clauses 45 CFR 164.504(e) requires, where vendors narrow them, and what to verify first.
Solomon Amos · 9 Sep 2026 · 11 min read
The General Court dismissed the challenge to the EU-US DPF in September 2025 and an appeal (C-703/25 P) is pending. Practical steps for vendor reviews that rely on DPF listings, with the timeline.
Solomon Amos · 8 Sep 2026 · 9 min read
What a DPF listing proves, the usage end date, the UK and Swiss extensions, the pending Court of Justice appeal, and how to read a DPF row before you sign a DPA.
Solomon Amos · 7 Sep 2026 · 10 min read
The IAF transition ended on 31 October 2025. What changed between the editions, why 2013 certificates are lapsed for accredited purposes, and how to read scope, sites and surveillance on a certificate.
Solomon Amos · 1 Sep 2026 · 10 min read
The questions to answer before you email sales, in the order that saves the most time: registries first, vendor statements second, questionnaires last. With the numbers on why.
Solomon Amos · 30 Aug 2026 · 11 min read
