attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
Sully
AI tools
Autonomous team of AI agents that runs the entire hospital operations
Synder
Finance and accounting
Financial data your AI can actually trust
TamLabs
AI tools
Agent teams for complex work
TapTap Send
Payments
Send money to Africa, Asia and Latin America in
Tasklet
Productivity
Agents that own the work
Tesorio
Finance and accounting
Tesorio is the cash flow performance platform that helps finance…
testRigor
Developer tools
Executable specifications in English for test automation
TetraScience
Data platforms
The only R&D data cloud for life sciences
The Token
DevOps and observability
Compression middleware that improves LLM outputs
Tractian
Manufacturing and industrial
Physical AI for asset-heavy industries
OpenTag
AI tools
Model Agnostic AI coworker in Slack
Scott AI
Procurement
The planning layer for teams that build with coding agents
UpKeep
Manufacturing and industrial
Mobile-first software for maintenance teams.
Boom AI
AI tools
AI agents that recover lost revenue through real conversations.
Crunched
Productivity
Excel AI analyst for Power Users
Fini
AI tools
Fini | Automate 80% of enterprise support with AI agents
Third Chair
Legal tech
AI-Native IP Enforcement Agent
Velt
Developer tools
SDK for adding an agent and human governance layer to your product
Veriad
Marketing
AI operating system for advertising
Veriff
AI tools
Veriff is a global AI-native identity platform building trust online
Vitalize
Healthcare
Transforming how health systems optimize labor
Warmly
Sales tools
[Acquired by HubSpot in 2026] Autonomous sales platform to auto-email…
Whalesync
Data platforms
Manage your website from your favorite tools like Airtable and Notion
Within
AI tools
Company Brain for people and agents to work in harmony.
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read