Explainers
What Is Third-Party Risk Management (TPRM)? A Practical Guide
Solomon Amos · 2 Nov 2026 · 10 min read
attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
ClickUp
Project management
Our mission is to make the world more
Axiom
Data platforms
The modern machine data platform — Petabyte-scale, schema-less ingest on a fully managed event store, so you keep every byte without the
Replit
Developer tools
Collaborative in-browser IDE
Lucid
Research and data providers
Discover the power of Cint Exchange, the largest online
Delinea
Identity and access
Try Delinea's AI-driven identity security, authorization and PAM solutions to secure privileged access across your organization in real
Lattice
HR and HRIS
Modern people management platform.
RE
Resend
Communications and CPaaS
Email for developers
Ambassador
getambassador.com
Grow, keep, and prove revenue from the customers you already
Formal
Security
Take control of your data in real-time.
Retool
Developer tools
Build internal tools fast.
Vapi
AI tools
Voice AI for developers.
Cortex
DevOps and observability
Cortex is the Internal Developer Portal eliminating “developer tax”…
Dashlane
Identity and access
Top-rated password manager and credential protection solution for enterprises, businesses, and
Segment
Data platforms
Software and APIs to collect, clean, and control customer data.
Anaconda
Analytics
Anaconda is the trusted foundation for AI-native
Demandbase
No-code and automation
Elevate your B2B go-to-market strategy with Demandbase's ABM platform, delivering smarter insights, agent-led automation, and AI-powered
Freshpaint
Developer tools
Customer data collection, safeguarding, & activation for healthcare
Thread
Customer support
Supercharge your service desk with effortless assistive and agentic AI—no new hires required and guaranteed
Jitterbit
No-code and automation
Ignite business productivity with data orchestration, iPaaS, workflow automation, and low-code app development solutions—all on one unified
Notion
Collaboration
Build Custom Agents, search across all your apps, and automate
ON24
Video conferencing
ON24 Inc., a San Francisco-based company, is a cloud-based platform that develops and sells web-based webinar, virtual conferencing
Sisense
Analytics
Sisense delivers AI-powered embedded analytics to unlock insights and convert data into revenue with pro-code, low-code, and no-code
Vela
Recruiting
AI Recruiting Coordinator for Executive Search
Unanet
CRM
Unanet’s ERP and CRM solutions drive bottom-line growth by connecting your projects, people and financials with greater efficiency and
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesExplainers
What Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read