Trust centers for SOC 2 companies
A SOC 2 report is the heaviest document in most trust centres. How you present it decides whether a reviewer reads a finding as a risk or as a company that fixes things.
A trust centre for a company with a SOC 2 report states the report type and period publicly, gates the report itself behind an NDA, and puts the bridge letter, management responses to any exceptions, and a plain-language summary of complementary user entity controls next to it. It also shows when the next report is due. Those four items answer most of what a reviewer asks after reading the report.
What about our SOC 2 should be public?
The report type, the Trust Services Criteria covered, the period, the issue date and the next expected period. For example: "SOC 2 Type 2, Security and Availability, 1 January to 31 December 2025, issued 14 March 2026." Do not publish the report itself; it is restricted use. See sharing a SOC 2 report.
What should sit next to the report?
- Bridge letter
- Your statement covering the time since the period ended, confirming no material changes. Refresh it every few months. GetSOC2 explains its limits.
- Management response to exceptions
- If the auditor noted exceptions, a short response saying what happened and what changed. Reviewers read exceptions first.
- Complementary user entity controls
- The controls the report assumes your customer runs, such as managing their own users. Summarised plainly, they prevent a reviewer thinking you missed them.
- Subservice organizations
- Where the report carves out your cloud provider, link that provider's own reports.
How do we keep the SOC 2 section current?
Put three dates in the calendar: the end of each report period, when a bridge letter should be issued, and when the new report is expected. Replace the report on the day the new one is issued and retire the old one. A trust centre showing an expired period without a bridge letter is the most common reason a reviewer asks for a call.
Common questions
Should our trust centre say "SOC 2 certified"?
No. SOC 2 is an attestation report, not a certification. Say "SOC 2 Type 2 report available" with the period. Reviewers notice the wrong word and wonder what else is imprecise.
Should we show exceptions on the trust centre?
Not publicly. Put the management response in the gated library beside the report, so the reviewer reads your answer alongside the finding.
Present your SOC 2 properly
Get a trust centre set up around your report, or run for you.
Get matched