attestation
SOC 2 evidence across 765 vendors
SOC 2 is an attestation report, not a certification. A CPA firm examines controls against the AICPA trust services criteria and issues a restricted-use report for a period. CertReports indexes what is public: the report type, period and auditor where the vendor or a registry states them, plus the CSA STAR Level 2 attestations built on SOC 2 examinations.
- Verified rows
- 21
- Vendor-stated
- 744
- Expired
- 0
- Last verified
- 2 Nov 2026
ClassDojo
Education
Communication app for K-8 teachers, kids, and families
Icertis
Research and data providers
The Icertis platform delivers an enterprise–wide contract intelligence layer that understands business and industry context – connecting
Homebase
Payroll
Build schedules, track time, run payroll and hire in one easy
ON24
Video conferencing
ON24 Inc., a San Francisco-based company, is a cloud-based platform that develops and sells web-based webinar, virtual conferencing
AudioEye
Compliance and GRC
AudioEye, Inc. (AudioEye) is an industry-leading platform delivering website accessibility compliance at all price points to businesses of all sizes. Audi...
Copado
DevOps and observability
Copado is the #1 Intelligent DevOps Platform for Salesforce, trusted by 1,700+
Courier
Developer tools
The fastest way for developers to build notifications for their app.
CyberFOX
Identity and access
CyberFOX provides MSPs and IT Pros with identity access management (IAM) solutions in password management and privileged access
exiger
Procurement
AI-powered supply chain management technology that's changing the way corporations, government agencies and banks navigate risk and
FastSpring
Payments
Sell globally and stay compliant with our merchant-of-record
GBG
Identity and access
We offer a range of solutions that help organisations quickly validate and verify the identity and location of their
Karat
Research and data providers
The trusted standard for technical interview and screening
Litera
Legal tech
More than 1 million daily users legal professionals and 99% of the Am Law 100 amplify their impact with Litera’s legal technology
Tidio
Customer support
See what your customer conversations
Valimail
Identity and access
Protect your business from phishing and spoofing 4x faster with Valimail’s automated DMARC, DKIM, and SPF email authentication
vFairs
Video conferencing
Run registration, ticketing, mobile apps, check-in & virtual events on one
Vyond
Design tools
GoAnimate, Inc., doing business as Vyond since 2018, is an American privately held software company based in San Mateo, California
Project Affinity
Research and data providers
Affinity helps private equity and VC firms source deals, manage relationships, and close faster with AI-powered relationship intelligence
Airwallex
Payments
Grow your business faster with Airwallex - global business accounts, high speed transfers, multi-currency cards, online payments, embedded
Allvue Systems
Finance and accounting
Streamline private capital operations with Allvue’s AI-powered alternative investment software that automates accounting, investor
Anedot
Nonprofit and fundraising
Trusted by more than 30,000 organizations, Anedot saves you time and money with powerful online giving, fundraising, and event management
Appfire Technologies
appfire.com
AppOmni
Security
Gain complete SaaS visibility, strong posture, and agentic AI governance with AppOmni, the leading SSPM and AISPM platform for
Software AG Government Solutions
aris.com
Most AI initiatives fail to scale because agents don’t understand how enterprise organizations
Type I versus Type II
A Type I report describes controls at a point in time. A Type II report tests them over a period, commonly six to twelve months. Most buyers ask for Type II covering the last twelve months, or an older report with a bridge letter of at most three months.
Why nobody is "SOC 2 certified"
The AICPA issues no certificate and keeps no registry of audited organisations. A vendor that says "SOC 2 certified" usually means it has a report; CertReports records the report claim and flags the terminology.
How to get the report
SOC 2 reports are shared under NDA through the vendor trust centre. CertReports links to the request flow and never hosts, caches or summarises the report beyond facts the vendor has already published.
Guides on SOC 2
All articlesWhat Is a Trust Centre? Vendor Evidence vs Office Settings
Solomon Amos · 28 Oct 2026 · 10 min read
What Is NIS2? Mapping Its Vendor Rules to Real Evidence
Solomon Amos · 21 Oct 2026 · 9 min read