attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
Payna
AI tools
AI Licensing Agent for Regulated Industries
Petrarch
Data platforms
Advancing model capabilities for critical infrastructure
Polytomic
Data platforms
No-code data syncing between your systems
The Prompting
Marketing
We help products get discovered & used by AI agents.
Propexo
Developer tools
Plaid for Commercial Real Estate
Quartzy
E-commerce
Marketplace for life science supplies.
Quo fka OpenPhone
AI tools
The all-in-one business phone for teams.
Qventus
AI tools
We automate operations for hospitals and health systems
Raindrop
AI tools
Sentry for AI Agents
Rimba
Energy and climate
Streamlining Data Capture to Report Creation for Heavy Industries
Roboflow
AI tools
🖼️ Give your software the sense of sight.
SafetyKit
Compliance and GRC
AI agents for risk, compliance, and safety
Salt Security
Security
Protects organizations from getting breached through their APIs.
Sand Solutions
Government and public sector
Secure, U.S.-based cloud hosting for government
Sharebite
Benefits and insurance
The #1 corporate meal benefits and group ordering platform for modern
SigNoz
Developer tools
Open source alternative to DataDog
SketchDeck
Productivity
Operating system for creative agencies
Skyhook
Developer tools
PaaS-like experience with the power of Kubernetes, on your cloud
Slashy
AI tools
Soraban
Finance and accounting
AI tax workflow platform for accounting firms
Sparkles
Design tools
Make everyone on your team an engineer
Spinach AI
AI assistants
The System of Action for Conversation Data
Spline
AI tools
Design and collaborate in multiple dimensions.
Stilta
AI tools
Agentic AI for intellectual property
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read