SOC 2 certificate?
SOC 2 ends in an auditor's opinion, so stop calling it a certificate.
Sales decks, trust pages and even contracts mention a SOC 2 certificate. That document does not exist. A CPA firm delivers a report holding its opinion on your controls for a stated date or window. The distinction sounds pedantic until a security reviewer spots the word and starts doubting the rest of your answers.
Back to SOC 2 services01 · Why the word fails
Three features of a certificate that SOC 2 lacks
A certificate has an accredited issuer, a granted status and a validity date. A SOC 2 report has none of the three.
- An accredited issuerCertificates come from a body accredited to certify against a standard. The AICPA writes the SOC 2 criteria and the attestation standards but accredits nobody to certify against them. The signer is a CPA firm acting under its own licence.
- A granted statusA certificate is awarded or refused. A SOC 2 opinion takes one of four forms (unmodified, qualified, adverse, or a disclaimer of opinion), and even a clean one can sit beside listed deviations.
- An expiry and a registerCertificates carry an end date and can be looked up. A SOC 2 report describes a past date or window, prints no expiry, and appears in no public directory.
So the honest noun is report and the honest verb is examined. The rest of this guide follows from those two words.
02 · Next to ISO 27001
Set beside a genuine certificate
ISO/IEC 27001 is the certificate most people have in mind. Comparing the two shows what each one proves.
ISO/IEC 27001
A certificate for a management system
- Granted by a certification body after a certification audit
- Shows a number, a scope statement and a validity date
- Kept alive by surveillance audits inside a three-year cycle
- Findings are recorded as nonconformities to be closed
SOC 2
An opinion on controls
- Signed by a licensed CPA firm under AICPA standards
- Shows a system, the categories, and a date or window
- Has no built-in validity; each reader judges whether it is recent enough
- Findings appear as deviations in the test results and can alter the opinion
Neither replaces the other. Plenty of vendors hold both and send whichever the buyer's form requests.
03 · Where it comes up
Five places the certificate question appears
The pull towards 'certified' shows up in predictable spots. Each has a better reply.
| Where | What the other side really needs | A reply that holds up |
|---|---|---|
| Your trust page | Proof an examination happened and a route to the detail | Name the report type, the window end date and the examining firm, and explain how to request the full report under NDA |
| A form field labelled 'certificate number' | Something to file against your supplier record | State that SOC 2 issues no number, then attach or offer the report itself |
| A contract clause to 'maintain certification' | Assurance for the whole contract term | Offer a duty you can meet: keep a current Type 2 report for the named system, share it on request, and supply a bridge letter between reports |
| A tender asking for an accredited certificate | A document from an accredited issuer | SOC 2 cannot satisfy that wording; an ISO/IEC 27001 certificate usually can, with the SOC 2 report as supporting detail |
| A sales call | Confidence that you can be trusted with data | Say a CPA firm examined your controls and gave an unmodified opinion for the latest window, if that is what the report shows |
Never make up a certificate number to get past a mandatory field. A reviewer who asks to see the matching certificate will find nothing, and the invented value becomes the finding.
04 · The badge
The AICPA badge is permission, not proof
A logo licensed by the AICPA may appear on your site. It carries far less information than the report behind it.
What a badge tells a reader, and what it leaves out
The AICPA licenses SOC logos to organizations that meet its conditions, which include a report without a modified opinion and keeping the logo current. A badge signals that a report exists. It says nothing about the type, the window, the categories or the system, which are the very points a reviewer checks.
Advisers and software platforms cannot present your badge as their own credential. If you want a public document with more substance than an image, a SOC 3 report is built for general distribution.
05 · Checking a vendor
When a supplier tells you they are certified
Treat the word as a cue to request the report, then read six things in this order.
- Get the report, not a summary. A slide, a badge or a SOC 3 is not the detailed SOC 2. Ask for the full document under NDA.
- Find the signature. Look for the CPA firm's name and signed opinion at the front, then confirm the firm's licence with the relevant state board of accountancy.
- Read the form of opinion. Unmodified is the clean form. A qualified or adverse opinion, or a disclaimer, limits how far you can rely on the report.
- Match the system to your purchase. The description must cover the product, environment and region you are buying, not a sister service.
- Note the window and its age. A Type 1 names one date; a Type 2 names a start and an end. If the end is some way back, ask management for a bridge letter covering the gap.
- Read the deviations and your own duties. Scan the results for deviations, and list the complementary user entity controls you must run for the supplier's controls to work.
Sources: AICPA attestation standards AT-C section 105 and AT-C section 205; AICPA Guide, SOC 2 Reporting on an Examination of Controls at a Service Organization Relevant to Security, Availability, Processing Integrity, Confidentiality, or Privacy; AICPA, TSP section 100, 2017 Trust Services Criteria; AICPA SOC logo terms of use; ISO/IEC 17021-1 and ISO/IEC 27006 on certification audits.
06 · Go deeper
Go deeper
Dedicated pages on topics this guide only touches.
Certificate questions we hear often
Our deck already says 'SOC 2 certified'. Does it really matter?
Enough to fix before the next review.
Experienced reviewers read the word as a sign the team does not know what it holds. Swap it for the report type, the window and the examining firm, and the same slide starts to show maturity instead.
Is a SOC 3 report the public certificate, then?
No. It is a public report.
A SOC 3 is a general-use report on the same examination, with less detail. It still carries an opinion rather than a certification, and it still describes a date or window rather than granting a status.
Can a consultancy or compliance platform award SOC 2?
No.
Only a licensed CPA firm that is independent of you can perform the examination and sign the opinion. Advisers, Auditify among them, prepare you, test readiness and help close gaps. Software tracks evidence. Neither issues anything.
Can a buyer look up whether we have a SOC 2?
Not in any public register.
There is no lookup where a buyer confirms a supplier's SOC 2 status. Verification means reading the report itself and checking who signed it.
What do we upload when a portal insists on a certificate file?
The report, or a short cover note.
Upload the SOC 2 report if the portal sits under your NDA, or a cover note explaining that SOC 2 produces an attestation report available on request. Add an ISO/IEC 27001 certificate if you hold one.
Describe your examination the way a reviewer would.
A SOC 2 readiness assessment gets you ready for a CPA firm's examination and leaves you with wording you can defend on every page and form.