attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
Medallia
Education
Medallia is an American customer and employee experience management company based in Tysons, Virginia
Sprinklr
Customer support
Sprinklr is a provider of enterprise software solutions that help organizations unify customer-facing functions across digital
WalkMe
Productivity
WalkMe provides a platform for on-boarding and simplifying of user experience in web based
Bugcrowd
Security
Bugcrowd enables organizations to do everything proactively possible to avoid being blind-sided by
Expedient
DevOps and observability
Expedient combines data centers, network access and managed services to deliver information technology infrastructure as a service (IaaS)
HireVue
Recruiting
At HireVue, we exist to connect talent to opportunity and unlock the potential in every candidate—because everyone has
Revinate
Travel and hospitality
We power 950 million+ guest profiles and $17.2 billion in direct revenue for over 12,500 hotels
ScienceLogic
IT management
ScienceLogic is a leader in IT Operations Management, providing modern IT operations with actionable insights to predict and resolve
Altana
altana.ai
Articulate Global
Education
Articulate Global, LLC. (Articulate) was founded in 2002 to simplify e-learning development and expand access to training globally. The company offers its...
Contrast Security
Security
Secure AI-generated code with
Kentik Technologies
DevOps and observability
Kentik is the network intelligence platform for modern infrastructure
Moodle
moodle.com
Simetrik
Finance and accounting
No code enterprise SaaS for financial control automation.
Contentful
Developer tools
Contentful is a German-American headless content management system (CMS), founded in 2013 in Berlin, Germany, by Sascha Konietzke and Paolo
Vanta
Compliance and GRC
Vanta—the proven leader in automated compliance helping startups…
Deltek
Project management
Deltek is a leading global provider of enterprise software and information solutions designed to help project-based businesses optimize
Cornerstone OnDemand
HR and HRIS
About Cornerstone: Cornerstone powers the future-ready workforce with a next generation talent experience platform designed to unite
DataBank
Cloud and hosting
DataBank’s Managed Cloud transforms our Standard Cloud (IaaS) service into a comprehensively managed Platform-as-a-Service (PaaS)
OneStream Software
Finance and accounting
OneStream Software provides a revolutionary corporate performance management (CPM) solution that unifies and simplifies financial
Phenom People Inc. Phenom
Recruiting
Phenom is a global HR technology company that delivers its AI-powered Talent Experience Management (TXM) platform to enterprises, enabling
SailPoint Technologies
Identity and access
SailPoint is the leader in enterprise cloud identity
OpenAI
AI infrastructure
OpenAI is an AI research and deployment
Wiz
Security
Wiz is on a mission to transform cloud security for customers – which include 40% of the Fortune 100 – by empowering them to embrace a new
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read