Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
Canva
Design tools
Canva, Inc. is an Australian multinational software company launched in 2013
Fireflies.ai
AI assistants
Fireflies takes notes, manages tasks, and automates workflows across meetings, email, chat, CRM, and your
Glean
AI assistants
Glean is the Enterprise AI platform connected to your enterprise's
Sardine
Security
The top agentic risk platform used by leading banks and merchants worldwide to stop fraud in real-time, prevent AI-driven attacks, automate
Snyk
Security
Every AI-building team faces one question: can you trust what you're shipping? Snyk secures the code AI writes, the agents it runs, and the
CoLab
Collaboration
Human and AI design review for hardware
Magenta
Manufacturing and industrial
Magenta is the agent platform that automates complex manufacturing
Axonius Federal Systems
axoniusfed.com
CirrusMD
Logistics and supply chain
See how CirrusMD is reimagining the Point of Care in a new physician-first care and guidance delivery
H2O.AI for Government
AI infrastructure
Only H2O.ai provides an end-to-end GenAI platform where you own every part of the
Judi Health
Benefits and insurance
Judi Rx delivers transparent, member-focused PBM solutions, while Judi Care provides medical, vision, and dental benefits through Judi®
Level Access
Compliance and GRC
From testing and fixing to reporting, our digital accessibility platform provides everything you need for globally compliant
NEOGOV
Government and public sector
NEOGOV is a AI-enabled government software company that provides a one-stop HR suite for the public
Patlytics
Research and data providers
Reduce cycle times. Increase margins. Augment research. Deliver winning IP outcomes.
Qgenda
Healthcare
Healthcare Workforce Management software to boost engagement and retention, optimize staffing, and reduce labor
Second Front Systems
secondfront.com
Stuck in authorization limbo? Get DoD authorization (ATO) or FedRAMP authorization in weeks, not
Stell Engineering
Compliance and GRC
AI-native requirements management for engineers managing mission-critical
Valid8 Financial
Finance and accounting
Transform raw banking evidence and accounting data into evidential proof that’s complete, accurate, and ready for the courtroom or
VisibleThread
Research and data providers
Full-lifecycle RFP intelligence, traceable AI insights, and security without
Algolia
Developer tools
A developer-friendly and enterprise-grade search API.
Alloy
Identity and access
AI prototyping tool for product managers
Routable
Payments
Simplifying payouts at scale
Culture Amp
HR and HRIS
Empower your teams and fuel positive change with performance, development, and employee engagement tools – all-in-one intuitive employee
LangChain
AI infrastructure
LangChain is a software framework that helps facilitate the integration of large language models (LLMs) into applications
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesExplainers
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read