SOC 3
Public Trust Report

A SOC 3 report is the public-facing, general-use version of a SOC 2 report. It is based on the same AICPA Trust Services Criteria and the same audit, but presents the auditor's opinion without the detailed control descriptions and test results that make a SOC 2 confidential. That means a SOC 3 can be freely published — it works as a trust seal you can place on your website or share in marketing.

SOC 2 and SOC 3 cover the same Trust Services Criteria and stem from the same audit, but differ in audience. SOC 2 is a restricted-use report containing detailed control descriptions, tests, and results — shared under NDA with customers and auditors. SOC 3 is a general-use summary that contains the auditor's opinion and system overview but omits sensitive detail, so it can be distributed publicly. Most organizations obtain SOC 2 for due diligence and add SOC 3 for open marketing use.

In practice, yes. A SOC 3 is produced from the same examination as a SOC 2, so the underlying audit work (scoping, control design, and testing against the Trust Services Criteria) has to be completed regardless. Tranquility Cybersecurity typically delivers SOC 2 and SOC 3 from a single engagement, giving you the detailed report for prospects in due diligence and the public report for your website.

Yes — that is the primary purpose of SOC 3. Because it discloses no confidential control detail, you can publish the report and display the associated trust seal on your website, sales collateral, and security pages. It signals an independently examined security posture to prospects without requiring an NDA, shortening early-stage trust conversations.

Like SOC 1 and SOC 2, a SOC 3 examination results in an opinion issued by a licensed CPA firm under AICPA attestation standards. Tranquility Cybersecurity (TCSA) prepares your environment, designs and documents the controls, and runs the engagement to issuance, working with licensed CPAs for the formal attestation. TCSA has supported 250+ SOC 2 engagements, the basis from which SOC 3 reports are produced.