SOC 2: which SaaS vendors say they have a report, and how to get it

114 of the 148 vendors whose certification pages we read list a SOC 2 report. Here is what each one states: the report type in its own words, whether and how the report can be had, the scope or audit period where it gives one, and where and when we read it. Last read on 2026-11-09.

Vendor by vendor

"Type, as written": the type the vendor names, in any spelling (Type 2, Type II, Typ II). A vendor that writes only "SOC 2", or "SOC 2 + HIPAA", is shown as not stating a type; that is what its page says, not a finding that it has no Type 2 report. "Report on request": the vendor says customers can get the report, usually through its trust centre or under NDA. "Report published": the vendor links the report itself. "Stated": the vendor names SOC 2 and links nothing behind it. "SOC 3": the vendor also lists a SOC 3 report (40 of 114).

What a SOC 2 report is

SOC 2 is an examination by an independent certified public accountant under the AICPA's attestation standards. The auditor reports on a service organisation's controls against the AICPA's Trust Services Criteria, in up to five categories: security, availability, processing integrity, confidentiality and privacy. Security is always in scope; the organisation chooses the others (AICPA, Trust Services Criteria). The result is a report: the organisation's description of its system, management's assertion, the auditor's opinion and, in a Type 2 report, the tests and their results. It is not a certificate, and no register of SOC 2 reports exists.

Type 1 and Type 2. A Type 1 report gives the auditor's opinion on whether the controls were suitably designed as of one date. A Type 2 report also covers whether they operated effectively over a period, and lists the tests the auditor ran. The period is chosen by the organisation: the periods vendors state in this table run from six months (Lovable, February to August 2026) to twelve (OpenAI and Vercel, July 2025 to June 2026).

SOC 2 and SOC 3. A SOC 2 report is written for customers and others who understand the system, which is why vendors hand it out under NDA or behind a trust centre login. A SOC 3 report covers the same criteria with less detail and is meant for general use, so a vendor can publish it (AICPA, SOC 3). Some vendors also issue a bridge letter, which covers the gap between the end of the last report's period and the date of the next one.

Vendors whose list does not include it

We read the certification pages of these 34 vendors and found no mention of SOC 2. That is what their pages say, not proof that no report exists: 3DS Outscale, Amplitude, Bleu, Box, Brevo, Cisco Webex, DATEV, Delos Cloud, Element, Eventbrite, Google Analytics, Hetzner, Hostinger, IONOS Cloud, Infomaniak, Mentimeter, Nextcloud, OVHcloud, PayPal, Pennylane, Personio, Pleo, S3NS, STRATO, Scaleway, Shopify, Sinch, Spendesk, Squarespace, Tresorit, WeTransfer, Wire, iubenda, netcup.

Questions

Which SaaS vendors have a SOC 2 Type 2 report?

Of the 148 vendors whose certification pages this registry reads, 88 name a SOC 2 Type 2 report in their own words: 1Password, Adyen, Aircall, Airtable, Anthropic, Apollo.io, Asana, Atlassian, Backblaze, Bitwarden, Calendly, Canva, Clay, ClickHouse, ClickUp, Cloudflare, Contentsquare, CrowdStrike, Cursor, Databricks, Datadog, Deepgram, DeepL, DigitalOcean, Docker, Docusign, Doodle, Drata, ElevenLabs, Figma, Freshworks, GitHub, GitLab, Gong, Grafana Labs, Grammarly, Granola, HubSpot, Intercom, JetBrains, Kahoot!, KnowBe4, Langdock, Lovable, Lusha, Mailgun, Make, Mapbox, Miro, Mistral AI, Mixpanel, Mollie, monday.com, MongoDB, Mural, Netlify, OneTrust, OpenAI, OpenRouter, Optimizely, Perplexity, Pipedrive, PostHog, Proton, Qualtrics, Retool, Sentry, Slack, Snowflake, Stripe, Supabase, SurveyMonkey, Typeform, Usercentrics, Vanta, Vercel, Vimeo, Vonage, Webflow, WhatsApp Business, Wix, Workday, Zapier, Zendesk, Zoho, Zoom, ZoomInfo, Zscaler. Another 1 name only Type 1. 25 write "SOC 2" without a type.

How do I get a vendor's SOC 2 report?

Ask the vendor; a SOC 2 report is rarely public. 57 of the 114 vendors here say on their page that customers can get it, usually from a trust centre after signing in or accepting a non-disclosure agreement. 56 state that they have a report but say nothing about how to get it, so the route is the account manager or the security team. Where a vendor lists a SOC 3 report, that version can be read without asking.

Is SOC 2 a certification?

No. A SOC 2 report is an independent CPA's opinion on a service organisation's controls, issued for one period or one date. There is no certification body, no certificate and no public register, so "SOC 2 certified" is shorthand. What a reader can check is the report itself: who audited, what period it covers, which trust services criteria and which products are in scope, and whether the auditor noted exceptions.

Download the data (CSV): every row with its source and the date it was read.Cite as: eucsoft, “SOC 2: what SaaS vendors state”, https://eucsoft.com/en/certifications/soc-2/, data read up to 2026-11-09.

How this was read

Each week the registry reads every vendor's certification or trust centre page and records each standard it lists, quoted as written, with the scope it gives. The report type on this page is taken from those words only. A listing that changes waits for a person's review before it reaches this page. Each vendor's page carries its full certification list under "Assurance". Other standards: ISO/IEC 42001, ISO/IEC 27701, ISO/IEC 27017, ISO/IEC 27018, BSI C5, TISAX;SecNumCloud, from ANSSI's list; the other national cloud schemes (C5, ENS, HDS) are on the certifications page. Full method on the methodology page.