Searching for how to get a SOC 2 report usually means one thing: a procurement or security team needs the actual PDF, not the badge on a vendor's marketing page. The honest answer is that there is no universal download button. A SOC 2 report is a restricted-use document, and the three most common ways to actually get one, AWS Artifact, Azure's self-serve portal, and a vendor's NDA-gated request form, work in genuinely different ways. This guide maps all three, and what to do once the report lands in your inbox.
Why a SOC 2 report is not a public document
The AICPA's attestation standards require a SOC 2 report to carry restricted-use language naming the parties who may rely on it: the vendor, its customers during the review period, and other specified parties such as auditors or regulators. That restriction is why a vendor's trust centre can legally show a SOC 2 badge in public while keeping the report itself behind a login or a signed NDA. The badge is marketing. The report is the evidence, and it belongs to a smaller, named audience. If you have seen a vendor describe itself as "SOC 2 certified", treat the phrase as a flag rather than reassurance: there is no certificate to issue, only a report an auditor signs once, for a fixed period, addressed to specified readers.
The three real access paths at a glance
Despite the restriction, in practice there are three recurring patterns, and knowing which one applies saves days. Cloud infrastructure providers tend to self-serve. Everyone else tends to gate.
- AWS Artifact: self-serve inside the AWS Management Console, accept a standard NDA once, download SOC 1, SOC 2 and SOC 3 reports instantly.
- Azure Service Trust Portal: a similar self-serve model under a Microsoft account, with some documents gated by an online agreement rather than a negotiated contract.
- Typical SaaS vendor: a request form on the trust centre, a mutual NDA that sometimes needs legal review, and a wait for a security or sales team to release the file.
| Access path | How you get it | Who can request it | Typical gate |
|---|---|---|---|
| AWS SOC 2 report | AWS Artifact, inside the AWS Management Console | Any AWS account with Artifact permissions | Click-through NDA accepted once per account |
| Azure SOC 2 report | Service Trust Portal download | Any Microsoft account, some documents need a live subscription | Online agreement inside the portal, no separate paperwork |
| Typical SaaS vendor SOC 2 report | Request form on the trust centre | Prospective or current customers, sometimes only under contract | Mutual NDA signed before the report link is released |
How the three common SOC 2 request paths differ in practice.
- 3
- distinct SOC report types
- SOC 1 covers financial controls, SOC 2 covers security and related trust criteria, SOC 3 is the public summary
- 1
- login most cloud giants need
- AWS Artifact and Azure's Service Trust Portal both use self-serve console or portal access, no emailed NDA required
- 58%
- of vendors state a SOC 2 badge without naming the report type
- in the CertReports index on 2026-10-31
How to get AWS's SOC 2 report from AWS Artifact
AWS Artifact is AWS's single library for its own compliance reports and agreements, built because AWS is itself a vendor to millions of downstream companies that each need the same evidence. A sales-gated NDA process would not scale at that volume, so AWS put the reports behind a login instead.
- Sign in to the AWS Management Console with an account that has Artifact permissions.
- Open AWS Artifact from the console search bar or the Security, Identity and Compliance section.
- Go to Reports and search or filter for SOC 2.
- Accept AWS Artifact's standard non-disclosure terms if prompted, this happens once per account rather than once per report.
- Select the report covering the period you need and download the PDF directly.
AWS Artifact is your go-to, central resource for compliance-related information that matters to your organisation. It provides on-demand access to AWS security and compliance reports and select online agreements.
How to get Azure's SOC 2 report from the Service Trust Portal
Microsoft runs a comparable model through the Service Trust Portal. Sign in with a Microsoft account, open the Audit Reports or Compliance Manager section, and search for the SOC 2 report under the relevant Azure or Microsoft 365 service. Some documents require accepting an online agreement inside the portal before the download link appears, but that is a click, not a legal negotiation. The portal covers SOC 1, SOC 2 and SOC 3 for most Microsoft cloud services, plus ISO, FedRAMP and other framework reports in the same library.
The pattern is the same reason as AWS: a hyperscale provider has far too many customers to run a bespoke NDA email thread for every request, so the restriction is satisfied through online terms applied at scale rather than a signed document per customer.
The NDA-gated path most SaaS vendors still require
Outside the two hyperscalers, this is still the norm. A mid-market SaaS vendor's SOC 2 Type II report is restricted to named parties, and most vendors satisfy that by routing every request through a signed NDA before the PDF is released.
- 1
- 2
Submit the request
Give the vendor's legal entity name, your company's legal entity name, and the reason for the request, since the report will name the recipient.
- 3
Sign the NDA
Many platforms embed a click-through NDA. Others route to legal for a negotiated mutual NDA, which adds days or weeks depending on redlines.
- 4
Receive the file
Expect a time-boxed download link or a watermarked PDF, sometimes limited to a set number of views or days.
- 5
Check the period and type before relying on it
Note the audit window and whether it is Type I or Type II, since that decides what the report actually proves to your review.
What a vendor's trust centre tells you before you request anything
Before filing a formal request, check what the vendor already states in public. Most trust centres list whether SOC 2 is Type I or Type II, and some name the audit period, without releasing the PDF itself. That single line can decide whether you need the full report or whether a public statement is enough for your file. The card below pulls live data for one vendor; look at the SOC 2 row specifically, and compare it with the SOC 1 row next to it, since vendors sometimes hold one report type but not the other.
Paylocity · Trust report
Finance and accounting · Public evidence as of 26 Oct 2026
Framework overview
CertReports state for each framework with public evidence: 1 verified, 3 vendor-stated.
3Documents and agreements
Legal and review documents Paylocity publishes or offers, as of 30 Sep 2026.
- Business associate agreement · Public
- Subprocessor list · On request
- Privacy policy · Public
1Security practices
Public statements from Paylocity, shown as statements, not attestations, as of 30 Sep 2026.
- Penetration testing · report available
Reading the report once you have it
Getting the PDF is only the start. A full SOC 2 Type II report runs to dozens of pages of controls, testing results and exceptions, and the auditor's opinion sits in the first few pages while the detail buyers actually need is further in. How to read a SOC 2 report in 20 minutes walks through the sections in order: the opinion, management's assertion, the system description, the control matrix and the exceptions. Check the dates first, since a SOC 2 report covers a period rather than a single point in time, and the difference between SOC 2 Type I vs Type II changes what it actually proves. If the period ended months ago and the renewal has not landed, ask for a bridge letter to cover the gap rather than assuming the control environment has stayed the same.
Common mistakes that slow down the request
- Sending the request to a generic sales inbox instead of the security or compliance contact named on the trust centre.
- Signing an NDA under the wrong legal entity, then redoing the paperwork once procurement catches the mismatch.
- Assuming a SOC 3 report, the public summary version, is the same document; it is not restricted, but it also leaves out the control testing detail buyers usually need.
- Treating the PDF as the whole answer instead of folding it into a wider vendor risk review that also checks subprocessors, data flows and other frameworks the vendor states on its SOC 2 framework page.
People also ask
How to get SOC 2 report?
Ask the vendor directly through its trust centre or a named security contact, since SOC 2 reports are restricted-use documents rather than public downloads. Most vendors require a signed NDA before releasing the PDF. Cloud infrastructure providers are the exception: AWS and Microsoft Azure both offer self-serve downloads through AWS Artifact and the Service Trust Portal. Many vendor pages state whether they hold a SOC 2 report at all, before you even file a request.
How to get aws SOC 2 report?
Sign in to the AWS Management Console, open AWS Artifact, and search the Reports library for SOC 2. Accept Artifact's standard non-disclosure terms once per account, then download the PDF immediately. No email request or vendor sales process is involved, because Artifact is built for self-serve access to AWS's own compliance reports, covering SOC 1, SOC 2 and SOC 3.
How to download aws SOC 2 report?
From the AWS Management Console, navigate to AWS Artifact, choose Reports, filter by SOC 2, and select the report covering the period you need. On first use, accept the Artifact NDA that appears on screen. The file downloads as a PDF directly to your browser, with no separate approval step from an AWS representative.
How to get azure SOC 2 report?
Sign in to Microsoft's Service Trust Portal with a Microsoft account, open the Audit Reports or Compliance Manager section, and search for the SOC 2 report under the relevant Azure or Microsoft 365 service. Some documents need an online agreement accepted inside the portal first. A separate negotiated NDA or sales contact is usually not required for the standard SOC 2 Type II report.
What is aws SOC 2 report?
It is the independent auditor's report covering AWS's own security, availability and confidentiality controls, issued under AICPA attestation standards. It is not a certificate, and AWS is not "SOC 2 certified"; the report documents controls tested over a fixed period and is published through AWS Artifact for customers who need evidence for their own vendor risk reviews.
Solomon Amos · Founder, CertReports
Solomon builds CertReports, the public evidence index for vendor security reviews. PhD in machine learning and cybersecurity, two years embedded at HMRC digital programmes, founder of TapTax. He writes about what registries, trust centres and auditors actually publish, and how buyers can use it before the questionnaire goes out.
Read next on CertReports
You might also like
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read