SOC 3
Your SOC 3 is public. Say exactly what it covers.
A SOC 3 is made to be shared, so the risk moves from who sees it to how you describe it. A careless sentence on a trust page can claim more than the CPA firm's opinion supports. This page covers where to place the report, the AICPA logo, the wording that holds up, and how to handle a report that is getting old.
Back to SOC 2 services01 · Where it goes
Where a SOC 3 can sit
Anywhere public, as long as the whole report travels with the claim.
- A trust or security page, with the report as a download and a one-line summary of the period and categories.
- Tender and procurement responses, attached in full.
- Partner marketplaces and listings that ask for public assurance documents.
- Sales decks, as a link to the full report rather than a screenshot of the opinion.
Publish the report as issued, unedited. Extracting the opinion paragraph on its own strips out the period, the boundary and the categories that give it meaning.
02 · The logo
The AICPA logo and its terms
The mark belongs to the AICPA, and its guidelines govern its use.
Many people still speak of a SOC 3 seal. Today the AICPA offers a logo for service organizations that have received a SOC 1, SOC 2 or SOC 3 report from a licensed CPA firm, and it asks organizations to read its guidelines before downloading or displaying the mark. The AICPA owns the mark and sets the terms. Neither your adviser nor your CPA firm can grant it.
- Read the current guidelines. Download them from the AICPA when you are ready to use the logo, and keep a dated copy.
- Place it next to the report. Put the logo where the reader can reach the report it refers to.
- Remove it when the basis lapses. Treat the logo as tied to a current report, and check the guidelines for any stated limits.
03 · Wording
Wording that holds up, and wording that does not
Name the firm, the period and the criteria. Avoid words that promise outcomes.
| Claim | Acceptable? | Why | Better wording |
|---|---|---|---|
| Our SOC 3 report covers the period 1 April to 31 March | Yes | States the period the opinion addresses | Keep it, and add the categories |
| An independent CPA firm examined our controls against the Trust Services Criteria for Security | Yes | Names who examined, against what | Name the firm if you wish |
| SOC 3 certified | No | A SOC 3 is an attestation report, not a certificate | We hold a SOC 3 report for the period ... |
| SOC 3 compliant | No | There is no compliance status to hold | Our controls were examined; the report is available here |
| Our platform is secure | No | The opinion is about controls over a period, not a guarantee | Describe the controls, and link the report |
| Audited and approved by the AICPA | No | The AICPA sets standards; a CPA firm performs the examination | Examined by [CPA firm] under AICPA standards |
| SOC 3 by Auditify | No | Only a licensed CPA firm issues the report | Prepared with Auditify's readiness support, if you mention advisers at all |
A test for every sentence
Could the CPA firm point to its own report and say “yes, that is what we concluded”? If not, rewrite the sentence.
04 · Keeping it current
Keeping the published report current
A public report is read long after it was issued. Make its age obvious.
- Show the period beside the download. Readers should not have to open the PDF to learn its age.
- Plan back-to-back periods. Keep the next examination running so a new report follows the old one.
- Review the page when the system changes. A new product outside the boundary needs a line saying so.
- Keep the wording in one place. One approved sentence, reused across the site, deck and tenders.
05 · When it ages
What to do as the report ages
Readers commonly want a period that ended recently. Plan for the gap.
- Keep the old report up, with its period clearly shown, until the next one is issued.
- Add a short dated note that the next examination is under way, without predicting the result.
- Offer a bridge letter to customers who ask, as a management statement and not a CPA opinion.
- Replace the report and the summary line on the day the new one is issued.
- If the next report carries a modified opinion, take advice before publishing and update every claim that depended on the old one.
- Leaving an expired logo in the footer. The mark outlives the report and tells readers something no longer supported.
- Quietly removing the report. Customers notice. A dated note explains more than a missing link.
- Changing the year in the summary line only. The claim must always match the report actually on the page.
Sources: AICPA SOC 3 topic page (SOC for Service Organizations: Trust Services Criteria for General Use Report); AICPA SOC logos for service organizations page and SOC logo registration pages; AICPA System and Organization Controls communications guidelines (summary); AICPA SSAE No. 18, AT-C section 205, as amended. Wording examples are our own.
Questions about publishing a SOC 3
Can we put the SOC 3 behind an email form?
You can, but it is general use.
Nothing requires a gate. Some companies collect an email for sales follow-up. Do not add terms that suggest the report is confidential; it was issued for general use.
Can we display the AICPA logo without publishing the report?
Check the AICPA guidelines first.
The mark's use is governed by the AICPA's own guidelines for service organizations. Read the current version before display, and keep the report available to anyone the logo invites to look.
May we say “SOC 3 certified” if everyone else does?
No.
A SOC 3 is an attestation report with an opinion, not a certificate. “We hold a SOC 3 report covering the period ...” is accurate and just as clear.
Does Auditify provide the seal?
No.
The logo belongs to the AICPA and the report comes from a licensed CPA firm. Auditify prepares companies for the examination and reviews public wording; it issues neither.
Publish a SOC 3 that says exactly what it covers.
We review your trust page and sales wording against the report your CPA firm issued.