attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
Webflow
Design tools
Professional website design and publishing platform.
Postman
Developer tools
Postman is an API platform for building and using
Delinea
Identity and access
Try Delinea's AI-driven identity security, authorization and PAM solutions to secure privileged access across your organization in real
Trimble
Manufacturing and industrial
Easily connect physical and digital worlds with Trimble industrial
Amplitude
Analytics
Digital Analytics Platform
Dialpad
Communications and CPaaS
The only AI-driven, cloud-native business communications
Render
Cloud and hosting
Deploy and scale any app or agent from your first user to your
Ashby
Recruiting
All-in-one recruiting platform that empowers hiring excellence in…
Fly.io
Cloud and hosting
Run full stack apps close to your users.
RADAR
Compliance and GRC
Manage privacy and AI incidents with speed and consistency using RadarFirst’s proven platform, AI-assisted capabilities, and regulatory
CDW
Logistics and supply chain
The information technology products, expertise and service you need to make your business successful.Fast shipping, fast answers, the
Netlify
Developer tools
Create with AI or code, deploy instantly on production
Pipedrive
CRM
Pipedrive is the easy-to-use, #1 user-rated CRM
FullStory
Analytics
Fullstory helps companies understand and improve how humans and AI agents interact with digital
DoorDash
Travel and hospitality
Restaurant delivery.
Five9
Communications and CPaaS
Five9 delivers reliable cloud contact centre and AI services that empower organisations to deliver extraordinary customer
Apollo.io
Sales tools
Apollo is the foundation of your entire go-to-market strategy.
Harvey
Legal tech
Legal AI tailored for leading law firms and corporate legal teams
Laravel
Developer tools
Laravel is a framework for building modern web apps and AI
Affirm
Payments
Buy now pay later without the
Bitly
Marketing
Bitly makes it easy to create, share, and track short links and QR
Crossbeam
Sales tools
Crossbeam is the global standard for Ecosystem-Led
PubNub
Cloud and hosting
Power your real-time app with PubNub—the world's largest pub/sub
Celigo
No-code and automation
Build, run, and govern automation on one
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read