attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
Dropbox
Cloud storage
Backup and share files in the cloud.
Snowflake
Data platforms
Snowflake is a data platform built for the
Armis
Manufacturing and industrial
Armis is the first agentless, enterprise-class security platform to address the new threat landscape of unmanaged and IoT
Twilio
Communications and CPaaS
Build amazing customer experiences on the Twilio platform with APIs for SMS, RCS, voice, and email, plus conversational AI for smarter
Diligent
Compliance and GRC
Diligent's trusted GRC software helps boards and leaders clarify risk, elevate governance, and manage compliance in one secure, AI-powered
A-LIGN
Compliance and GRC
Find out why A-LIGN is trusted by over 6,400 clients for efficient, reliable audits that meet rigorous compliance
Ramp
Finance and accounting
Make expense management easy with Ramp's spend management
KnowBe4
Education
Everything you need to reduce human risk and secure your agents all in one platform: Security Awareness Training, Email Security, Agent
Halcyon
Security
Halcyon is the cyber resilience platform that Global 2000 companies rely upon to defeat ransomware-as-a-service-borne
Fivetran
Data platforms
The leader in automated data movement
BeyondTrust
Identity and access
BeyondTrust Corporation is an American company that develops privileged access management (PAM) and vulnerability management software
Freshworks
Customer support
Freshworks is a cloud-based CEM software suite that streamlines customer conversations across multiple channels including email &
Everbridge
Compliance and GRC
Ensure the safety of your people and assets with the Everbridge comprehensive critical event and business continuity
Abnormal AI
AI tools
Abnormal AI is the leading AI-native human behavior security platform, leveraging machine learning to stop sophisticated inbound attacks
Envoy
Legal tech
We provide full-scale international legal immigration services and a proprietary online platform related to managing all employment-based
Docebo
Education
Docebo’s AI-powered LMS helps world-class organizations train employees, partners, and customers on a unified
Axonius
Security
The Axonius Platform gives customers a comprehensive understanding of all assets, their relationships, and business-level
Celonis
Analytics
Celonis has one very simple goal: to analyze today’s processes to make tomorrow’s world more
Druva
Cloud storage
The Druva Data Resiliency Cloud is the only at-scale SaaS platform designed for your multi-cloud
Forcepoint
Security
Forcepoint is a global data security leader headquartered in Austin, Texas, delivering AI-native protection for sensitive data across
Illumio
Security
Explore Illumio, the world's first breach containment
Socure
Identity and access
Socure is the leading AI-powered identity verification platform trusted by 3,000+ customers to verify consumers, businesses, & employees
BigCommerce
E-commerce
BigCommerce, founded in 2009, is a leading open software-as-a-service (SaaS) ecommerce platform that empowers merchants of all sizes to
Flock Safety
AI tools
The first public safety operating system that eliminates crime.
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read