attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
Caplinked
Nonprofit and fundraising
CapLinked’s secure virtual data rooms streamline M&A, fundraising, and due
Chameleon Intelligent Tech
Analytics
Chameleon builds context on your product, identifies friction, creates in-app guidance, and monitors outcomes, so your product keeps
ClearlyRated
Analytics
Build reputation and gain insights for your B2B service organization with the ClearlyRated experience management
CodeSignal
Research and data providers
Discover the agentic skills intelligence platform that helps teams see, measure, develop, and grow skills clearly with
Compensation Tool
HR and HRIS
Seeking efficient compensation management solutions? We provide helpful compensation benchmarking tools! Elevate with our streamlined
Crucial Data Solutions
Research and data providers
TrialKit is a unified eClinical platform with embedded intelligence that helps sponsors and CROs design, build, manage, and analyze
CultureHQ
culturehq.com
Your personal AI agent detects which stories you need, collects them from employees, and publishes them across your
CyberCube Analytics
Insurance
CyberCube is the leading cyber risk analytics provider for the insurance industry, translating cyber risk into financial impact across
Data Intensity
Business services
Data Intensity is an industry-leading Oracle managed services provider, expertly working to simplify, optimize, and transform our clients'
Digication
Education
AI-powered platform giving institutions the assessment data, accreditation evidence, and student retention signals needed to make learning
Docufree
Cloud storage
Docufree is an intelligent document processing solution designed to capture, manage, and automate information for highly-regulated
DomainTools
Research and data providers
DomainTools provides DNS-based threat intelligence covering 97% of internet
DonorDock
Project management
Steward donor relationships with an easy-to-use nonprofit CRM with email, text, project management, and giving pages all in one
Donut Technologies
HR and HRIS
Donut is an employee experience platform that helps you automate and scale people programs, right in
Dozuki
Education
Empower frontline workers with Dozuki Connected Worker Platform, the best in standard work instruction and training
empowerid
Identity and access
Govern every identity and control every consequential action across people, machines, and AI agents on the EmpowerID Identity
Ethyca
DevOps and observability
Ethyca builds trusted data infrastructure to govern sensitive data in real time with automated inventory, consent, and AI
FareHarbor
Scheduling
FareHarbor is the best online booking software for your
GAN Integrity
Compliance and GRC
Operationalize compliance and third-party risk management with a single
Gather Presence
Video conferencing
Building a better way to meet online.
Gladly
E-commerce
Gladly brings agentic commerce to your site for premium ecommerce
Gorgias
Customer support
Drive more sales and automate support with AI Agent, Helpdesk integrated to your stack, Chat, FAQ and
Netsoft
Productivity
Track employee time, monitor productivity, and turn approved hours into payments and
HumanSignal
AI infrastructure
Labeling, evaluation, and quality workflows that deploy where your data lives and scale with the world's most demanding AI
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read