Skip to main content
OpenAI logo

OpenAI

SOC 2 evidence

OpenAI is an AI research and deployment

openai.comAI infrastructureLast verified 2 Nov 2026
Request the report Are you OpenAI?
SOC 2 mark, CertReports state Vendor-stated as of 2 Nov 2026Vendor-stated

OpenAI and SOC 2

OpenAI states it holds a SOC 2 Type II report. CertReports captured this on 2 Nov 2026 from its trust centre (Drata); it is a vendor statement, not an independent confirmation.

Evidence

Vendor-statedVendor states SOC 2 Type 2 on its trust centre
as of 2 Nov 2026 · confidence 80%
Kind
Type II
SourceCapturedQuoteLinks
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026SOC 2 Type 2
Live page Snapshotsha256 804d5fac32
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 5af5598b54
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 225f762fa5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 320cf72094
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 211041cf6a
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 417beb78fc
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 0505a30156
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 aa746675a4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 c9546a0bab
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 34fe0be747
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 8098707954
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 49c83f30da
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 e54ac0c8d5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 404413d113
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 73be9e789d
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 29285127eb
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026SOC 2 Type 2
Live page Snapshotsha256 5df4605a19
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026SOC 2 Type 2
Live page Snapshotsha256 b090637129
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026SOC 2 Type 2
Live page Snapshotsha256 a9a7f08585
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026SOC 2 Type 2
Live page Snapshotsha256 fe12c3b4bd
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026SOC 2 Type 2
Live page Snapshotsha256 8c0867bee4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026SOC 2 Type 2
Live page Snapshotsha256 bdacda3d9f
This is wrong
VerifiedSTAR Level 1 self-assessment (CAIQ)
as of 26 Oct 2026 · confidence 100%
Kind
Self-assessment
Issued or listed
9 Apr 2024
Products in scope
openai api, chatgpt enterprise, chatgpt teams, chatgpt edu
SourceCapturedQuoteLinks
CSA STAR registry
Official registry · HTTP 200
26 Oct 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 0c3d16dcbd
CSA STAR registry
Official registry · HTTP 200
19 Oct 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 6ebb015031
CSA STAR registry
Official registry · HTTP 200
12 Oct 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 be2cb50e52
CSA STAR registry
Official registry · HTTP 200
5 Oct 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 3b3fda577e
CSA STAR registry
Official registry · HTTP 200
29 Sep 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 aadfa82b54
CSA STAR registry
Official registry · HTTP 200
17 Sep 2026openai: STAR Level 1 self-assessment (CAIQ)
Live pagesha256 e7f124247f
This is wrong
Vendor-statedVendor states CSA STAR on its trust centre
as of 2 Nov 2026 · confidence 80%
SourceCapturedQuoteLinks
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026CSA STAR
Live page Snapshotsha256 804d5fac32
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026CSA STAR
Live page Snapshotsha256 5af5598b54
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026CSA STAR
Live page Snapshotsha256 225f762fa5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026CSA STAR
Live page Snapshotsha256 320cf72094
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026CSA STAR
Live page Snapshotsha256 211041cf6a
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026CSA STAR
Live page Snapshotsha256 417beb78fc
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026CSA STAR
Live page Snapshotsha256 0505a30156
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026CSA STAR
Live page Snapshotsha256 aa746675a4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026CSA STAR
Live page Snapshotsha256 c9546a0bab
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026CSA STAR
Live page Snapshotsha256 34fe0be747
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026CSA STAR
Live page Snapshotsha256 8098707954
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026CSA STAR
Live page Snapshotsha256 49c83f30da
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026CSA STAR
Live page Snapshotsha256 e54ac0c8d5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026CSA STAR
Live page Snapshotsha256 404413d113
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026CSA STAR
Live page Snapshotsha256 73be9e789d
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026CSA STAR
Live page Snapshotsha256 29285127eb
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026CSA STAR
Live page Snapshotsha256 5df4605a19
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026CSA STAR
Live page Snapshotsha256 b090637129
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026CSA STAR
Live page Snapshotsha256 a9a7f08585
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026CSA STAR
Live page Snapshotsha256 fe12c3b4bd
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026CSA STAR
Live page Snapshotsha256 8c0867bee4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026CSA STAR
Live page Snapshotsha256 bdacda3d9f
This is wrong
Vendor-statedVendor states SOC 3 on its trust centre
as of 2 Nov 2026 · confidence 80%
SourceCapturedQuoteLinks
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Nov 2026SOC 3
Live page Snapshotsha256 804d5fac32
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
31 Oct 2026SOC 3
Live page Snapshotsha256 5af5598b54
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Oct 2026SOC 3
Live page Snapshotsha256 225f762fa5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Oct 2026SOC 3
Live page Snapshotsha256 320cf72094
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Oct 2026SOC 3
Live page Snapshotsha256 211041cf6a
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
23 Oct 2026SOC 3
Live page Snapshotsha256 417beb78fc
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Oct 2026SOC 3
Live page Snapshotsha256 0505a30156
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
19 Oct 2026SOC 3
Live page Snapshotsha256 aa746675a4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Oct 2026SOC 3
Live page Snapshotsha256 c9546a0bab
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
15 Oct 2026SOC 3
Live page Snapshotsha256 34fe0be747
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
13 Oct 2026SOC 3
Live page Snapshotsha256 8098707954
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
11 Oct 2026SOC 3
Live page Snapshotsha256 49c83f30da
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
9 Oct 2026SOC 3
Live page Snapshotsha256 e54ac0c8d5
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
7 Oct 2026SOC 3
Live page Snapshotsha256 404413d113
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
5 Oct 2026SOC 3
Live page Snapshotsha256 73be9e789d
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
3 Oct 2026SOC 3
Live page Snapshotsha256 29285127eb
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
1 Oct 2026SOC 3
Live page Snapshotsha256 5df4605a19
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
29 Sep 2026SOC 3
Live page Snapshotsha256 b090637129
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
27 Sep 2026SOC 3
Live page Snapshotsha256 a9a7f08585
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
25 Sep 2026SOC 3
Live page Snapshotsha256 fe12c3b4bd
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
21 Sep 2026SOC 3
Live page Snapshotsha256 8c0867bee4
OpenAI trust centre (Drata)
Vendor trust centre · HTTP 200
17 Sep 2026SOC 3
Live page Snapshotsha256 bdacda3d9f
This is wrong

What is not public

  • The report period is not public, so CertReports cannot say whether the OpenAI SOC 2 report covers the last 12 months.
  • The audit firm is not stated in any public source CertReports has captured.
  • Trust services criteria in scope, carve-outs and bridge-letter status are only in the restricted-use report, which CertReports never hosts.
What SOC 2 means, and what it does not

SOC 2 reports are restricted-use and are never "certifications". A Type II report covers a period; freshness is the period end plus a bridge letter of at most three months. "SOC 2 ready" and "in progress" are not reports. No public SOC 2 registry exists; the strongest registry-grade signal is a CSA STAR Level 2 attestation, then a public SOC 3.

Read the SOC 2 guide and browse all vendors with evidence

Questions buyers ask

Is OpenAI SOC 2 certified?

No organisation is "SOC 2 certified": SOC 2 is an attestation report issued by a CPA firm, not a certification. OpenAI states it holds a SOC 2 Type II report as of 2 Nov 2026.

How do I get the OpenAI SOC 2 report?

SOC 2 reports are restricted-use documents shared under NDA. Request it through the OpenAI trust centre or security page; CertReports links to it and never hosts the report.

How does CertReports verify this?

Every state carries a capture date, a source and a snapshot link. Registry rows come from the official registry data; vendor statements come from the vendor’s own page or trust centre; nothing is inferred. Vendors can dispute any row and corrections ship within two business days.

Change history

  1. 17 Sep 2026SOC 2 evidence addedA SOC 2 row entered the index with state Vendor-stated.

Alternatives with SOC 2 evidence

Similar vendors (shared product tags or the AI infrastructure category) whose SOC 2 row is verified or vendor-stated, ranked by similarity.

Anthropic logo

Anthropic

AI infrastructure

Anthropic, PBC is an American artificial intelligence (AI) public benefit corporation headquartered in San Francisco, California

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state VerifiedFedRAMP mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedCyber Essentials mark, CertReports state Vendor-statedISO 42001 mark, CertReports state Vendor-stated
2 verified · 5 stated2 Nov 2026
Mistral AI logo

Mistral AI

AI infrastructure

Mistral AI SAS is a French artificial intelligence (AI) company headquartered in Paris

SOC 2 mark, CertReports state Vendor-statedISO 27001 mark, CertReports state Vendor-statedISO 27701 mark, CertReports state Vendor-stated
3 stated21 Sep 2026
Groq logo

Groq

AI infrastructure

Groq, Inc. is an American artificial intelligence (AI) company that builds an AI accelerator application-specific integrated circuit (ASIC)

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedGDPR mark, CertReports state Vendor-stated
3 stated21 Sep 2026
HumanSignal logo

HumanSignal

AI infrastructure

Labeling, evaluation, and quality workflows that deploy where your data lives and scale with the world's most demanding AI

HIPAA mark, CertReports state Vendor-statedSOC 2 mark, CertReports state Vendor-statedDPF mark, CertReports state Expired
2 stated2 Nov 2026

Understand SOC 2 evidence

All articles