Is There a SOC 2
Certificate?

No. A SOC 2 engagement is an attestation examination performed by an independent licensed CPA firm under AT-C sections 105 and 205, producing a report that contains an opinion. There is no certification body, no accreditation scheme behind one, no certificate number, and no register of report holders anyone can search. Where you see a "SOC 2 certificate", someone has designed a document with no standing in the AICPA framework. The instrument carrying the assurance is the report, and specifically the opinion in its first section.

It is factually wrong, and an experienced reviewer reads it as evidence that whoever wrote the page has not read the report. Write what you hold: "SOC 2 Type 2 examination completed for 1 January – 30 June 2026, reported on by an independent licensed CPA firm; report available under NDA." That is one line longer and answers the reviewer's first four questions — type, period, who performed it, how to obtain it. If you want a visual mark, the AICPA SOC logo is the legitimate option under its registration terms.

Certification is a conformity-assessment activity: an independent certification body audits your organization against a standard and issues a certificate, and that body is normally accredited under ISO/IEC 17021-1. Attestation is a professional service: a licensed CPA firm examines a subject matter and reports an opinion under the AICPA attestation standards. One produces a status with an expiry date; the other produces a professional opinion covering a stated period. ISO/IEC 27001 is the first; SOC 2 is the second.

It is less wrong, and common enough that few reviewers challenge it, but it remains imprecise. There is no SOC 2 rulebook to comply with — the trust services criteria are outcome-based, and each organization designs its own controls to meet them, which is why two reports in the same industry can look quite different. The accurate framing names the examination rather than a compliance state: "our controls were examined against the trust services criteria for security, availability and confidentiality, with an unmodified opinion."

The SOC for Service Organizations logo is available to an organization that has had a SOC 1, SOC 2 or SOC 3 report that does not contain a modified opinion issued by a licensed CPA, after registering with the AICPA and accepting its terms. That eligibility bar bites: a qualified, adverse or disclaimed opinion removes logo eligibility even though the examination was completed. Use is permitted for twelve months following the report date; if no new report is issued by then, use must stop. The artwork may not be altered except in size and must link to the AICPA’s SOC page. A separate logo exists for the CPA firms performing the examinations — a service organization may not use that one.

Give it a real date rather than leaving it blank or inventing one. Enter the end of the observation period as the reference date, and add in the nearest free-text field or the covering email that SOC 2 produces a report rather than a certificate, that no expiry applies, and when the next period ends. If the portal validates the field and rejects a past date — some auto-flag the vendor as lapsed before a human reads the note — enter the next period end instead and say so in the same note. Never enter a date derived from the report date, which implies an expiry that does not exist. For a certificate-number field, write "not applicable — SOC 2 produces a report; available under NDA".

No. A SOC 2 report is restricted-use: the attestation standards require an alert identifying the parties it is intended for, which for a SOC 2 means user entities, their auditors, and others with sufficient understanding of the service organization and its system. Publishing it distributes a restricted-use document beyond that group. What you can publish is a description of the engagement and, if you want a public artifact, a SOC 3 report — produced from the same examination for general use, carrying the opinion, management’s assertion and a high-level system description, but not the full DC 200 description or the description of the auditor’s tests and results.

Redline it before signature, because as written it is an obligation you cannot literally satisfy and it will be quoted back at renewal or during an incident. Replace it with something you can meet and evidence: maintain a current SOC 2 Type 2 report covering the named trust services categories and the system used to provide the services, issued by an independent licensed CPA firm, with consecutive observation periods leaving no uncovered gap, provided under NDA within a stated number of days of issue, with a bridge letter on request. The full clause text is in the "Copy these" section above.

Ignore the word and ask for eight things in one email: the report cover page, the opinion paragraph, the period dates, the Section 3 system boundary, the trust services categories in scope, the Section 4 exceptions and management responses, confirmation of the CPA firm’s license and independence, and a bridge letter if the period ended more than about ninety days ago. The answers tell you whether you are looking at a Type 1 or a Type 2, whether the product you are buying was in scope, and whether the opinion was modified. A vendor who answers all eight in one email is further along than one with a badge.

The opposite one. ISO/IEC 27001 certification is real, so the errors run the other way: claiming "ISO certified" without naming the certification body, holding a certificate from a body with no recognized accreditation, or displaying the ISO logo — which ISO does not license for that purpose, because ISO certifies nobody. The correct claim names the standard and version, the scope statement, the certification body, the certificate number and the validity dates, and displays the certification body’s mark.