attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
iManage
Legal tech
iManage was founded in 1995 and initially merged with Interwoven in
Wrike
Project management
Wrike is a work management platform that delivers real-time project and task insight to its
Everlaw
Legal tech
Transform your approach to litigation and
Panopto
Education
At Panopto, we believe that video can have a transformative effect on
Sauce Labs
Developer tools
What is Sauce Labs? Sauce Labs makes software work for everyone, when they want it
Lightspeed POS
E-commerce
Lightspeed Commerce is a point-of-sale and e-commerce software provider based in Montreal, Quebec, Canada
Vanta
Compliance and GRC
Vanta—the proven leader in automated compliance helping startups…
CrowdStrike
Security
CrowdStrike Falcon is the only solution to unify next-gen AV, endpoint protection and response, managed hunting, IT hygiene and threat
Halo
No-code and automation
Streamline your processes with Halo's workflow
Datadog
DevOps and observability
Datadog is a monitoring service for hybrid cloud applications, assisting organizations in improving agility, increasing efficiency, and
Okta
Identity and access
Okta is an Identity-as-a-Service (IDaaS) platform that provides a comprehensive suite of services focused on managing and securing user
Drata
Compliance and GRC
Drata’s AI-native compliance automation & agentic trust management platform powers GRC and assurance (GRC +A) for startups, mid-size
Cyera
Security
The Cyera Data Security system allows organizations to discover data categories and ensure that they are protected according to
GitLab
Developer tools
A complete DevOps platform delivered as a single application.
Axon
Government and public sector
Axon Enterprise, formerly known as TASER International, creates connected technologies for truth in public
Mimecast
Security
Mimecast provides email management as a single service in the cloud that helps customers slash on-premise email storage requirements
SentinelOne
Security
SentinelOne is redefining cybersecurity by pushing the boundaries of autonomous
Ironclad
Legal tech
AI-powered contract management
Pendo
Analytics
Pendo feeds product context to the apps and AI agents you build or buy, so you can understand your users, act where it counts, and drive
UKG
HR and HRIS
HR, Payroll, & Workforce Management
Netskope
Security
Netskope™, the leading cloud access security broker (CASB), helps enterprises find, understand and secure sanctioned and unsanctioned cloud
UiPath
DevOps and observability
UiPath Inc. is a Romanian-American multinational software company that develops artificial intelligence (AI) and agentic automation and
Acquia
Business services
Acquia, Inc. (Acquia) is a privately held, open-source digital experience company that supports customers using the free and open-source content managemen...
CircleCI
Developer tools
CircleCI provides a CI/CD cloud environment for software engineers to test their code and deploy
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read