attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
Brite
HR and HRIS
Software that helps employees pick their employee benefits.
Embrace
Data platforms
Modern user-focused observability built on OpenTelemetry
Exa
Developer tools
Web search rebuilt for LLMs
Firecrawl
Developer tools
Building the library for superintelligence.
FlutterFlow
Design tools
Application Development Platform (Native Mobile + Web Apps)
Pangolin
DevOps and observability
Open networking and security for your workforce, AI agents, and infra
Recall.ai
AI tools
The API to get recordings, transcripts, and metadata from meetings
Bernard
Business services
AI employees that run home appliance repair companies
Conductor
AI tools
Run a team of coding agents on your Mac
Extend
Developer tools
Production-ready document processing
Callback
No-code and automation
Effortless AI automation for business operations
Giga
AI tools
AI Support Agent for Enterprises.
Jasper
AI assistants
Jasper is a leader in creating content using Artificial Intelligence
Latent
AI tools
Medical language models to automate healthcare operations
Oxus
No-code and automation
AI-powered automation for internal audit workflows
Pierre
Developer tools
Pierre is a new, opinionated, git platform.
Quicknode
Developer tools
Tools & infra to build and scale high-quality blockchain applications.
Rally
Design tools
Agentic User Research Infrastructure
Raycast
Developer tools
Speed up non-coding tasks for engineering teams
ReadMe
Developer tools
Beautiful, personalized, interactive developer hubs
Reducto
Data platforms
The complete agentic document platform
Runway
AI tools
Easier and more reliable mobile app releases for teams.
Scape
AI tools
The intelligent inbox that works for you
Termius
Developer tools
Termius is an SSH client with team collaboration features
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read