attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 1 Nov 2026
OneLogin by One Identity
oneidentity.com
Procore Technologies
Real estate and property
Procore’s construction management platform connects the site and the
QlikTech
Data platforms
Qlik, now with Talend, delivers a data fabric and next-level insights with its end-to-end data integration, data quality, & analytics
Anthropic
AI infrastructure
Anthropic, PBC is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California
ElevenLabs
AI tools
ElevenLabs Inc. is a software company that specializes in developing natural-sounding speech synthesis software using deep learning
Strada
Insurance
AI agents that run insurance operations
Verint
Customer support
Close the AI outcomes gap with the Verint Open
Expel
Security
Expel provides leading managed detection and response services to thwart cyber adversaries from disrupting your business and improve your
Mixpanel
Analytics
Mixpanel is event analytics for builders that need answers.
8x8
Communications and CPaaS
8x8 business VoIP helps you serve your customers better with mobile, flexible solutions that help you do business anywhere
Expensify
Finance and accounting
Expensify, Inc. is an American software company that develops an expense management system for personal and business use
BetterCloud
IT management
BetterCloud is the first SaaS Operations Management platform, empowering IT and security teams to define, remediate, and enforce management
Beamery
Recruiting
Beamery’s Talent Operating System Attract, engage, and retain world class talent, power best in class candidate experiences, and manage the
ControlUp
Analytics
First generation IT analytics and big data forever changed the IT
C&R Software
Finance and accounting
C&R Software delivers solutions across the Debt Collection and Recovery lifecycle, empowering organizations to manage their end-to-end
Data Zoo
Identity and access
Data Zoo is a leading identity solutions provider and one of the fastest-growing tech companies in Australia (Deloitte Fast 50
Evervault
Compliance and GRC
Evervault specializes in data encryption and confidential computing, helping customers address data security and compliance across various
Fleetio
Automotive and mobility
We provide the comprehensive solutions and resources needed to run, repair and optimize vehicles and assets, so fleets gain control of
Form Assembly
Form builders and surveys
Collect clean, compliant data with FormAssembly's secure web
Grafana Labs
DevOps and observability
Grafana has become the world’s most popular technology used to compose observability dashboards with everything from Prometheus & Graphite
HIghRadius
Finance and accounting
World's #1 Autonomous Finance Platform to lower DSO, optimize working capital, fast-track financial close and improve
Incsub
Cloud and hosting
CampusPress, a division of Incsub, LLC, provides enterprise WordPress hosting solutions purpose-built for educational
JAMF Software
IT management
Jamf is a global provider of organization cloud-based mobile device management (MDM) hosting services that allow organizations to off-load
Localize
Translation and localization
Localize is a cloud-based translation management system that enables companies to bring their products to multilingual international
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read