attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
Worklytics
HR and HRIS
Analytics to improve how teams work and collaborate
zeroheight
Developer tools
The design system layer for coding agents
Zuddl
Video conferencing
Zuddl is a modular platform for events and webinars that helps event…
Ably
Cloud and hosting
Coud-based realtime messaging and AI infrastructure platform
Auth0
Identity and access
Secure users, AI agents, and more with Auth0, an easy-to-implement, scalable, and adaptable authentication and authorization
Buildkite
Developer tools
Buildkite is a continuous integration (CI) and continuous delivery (CD) platform used in DevOps
Clay
Sales tools
Infrastructure to get any data, run agentic workflows, and launch GTM
Clio
Legal tech
Cursor
Developer tools
Anysphere, Inc., doing business as Cursor, is a subsidiary of SpaceXAI which offers generative AI for producing computer code
Fireworks AI
AI infrastructure
Fireworks’ state of the art training and inference platform take you beyond the frontier, transforming open models into your specialized
Groq
AI infrastructure
Groq, Inc. is an American artificial intelligence (AI) company that builds an AI accelerator application-specific integrated circuit (ASIC)
Hotjar
Analytics
Contentsquare, the global leader in digital experience analytics, has joined forces with Hotjar, the leading product experience insights
Linear
Project management
Purpose-built for planning and building products with AI
Mistral AI
AI infrastructure
Mistral AI SAS is a French artificial intelligence (AI) company headquartered in Paris
n8n
No-code and automation
n8n is a workflow automation platform and the Berlin company, n8n GmbH, that develops it
Pinecone
AI infrastructure
Software business, developer of cloud-native vector database technology
Plaid
Finance and accounting
Plaid Inc. is an American financial services company based in San Francisco, California
Pulumi
Cloud and hosting
Pulumi is an open-source infrastructure as code platform that helps humans and agents build and manage cloud infrastructure with real
Sanity
Developer tools
Sanity is the back-end built for AI content
Synthesia
AI tools
Synthesia Limited is a British multinational artificial intelligence company based in London, United Kingdom
Together AI
AI infrastructure
Build what's next on the AI Native
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read