Use "audited" or "attested" only when an independent auditor has issued a report, "certified" only when a certification body has issued a certificate, and "aligned with" when you follow a framework without third-party assurance. When unsure, describe what you do and name the evidence. This is general guidance, not legal advice.
The four words
| Word | What it should mean | Needs |
|---|---|---|
| Audited | An independent party examined something | The audit actually happened |
| Attested | A CPA firm issued an attestation report, such as SOC 2 | A finished report |
| Certified | A certification body issued a certificate against a standard | The certificate itself |
| Aligned with | You designed controls with a framework as a guide | Your own mapping and evidence |
None of these means "secure." Each says something narrower about process.
Why the SOC 2 case trips people up
The AICPA describes the SOC suite as service offerings CPAs may provide, producing assurance reports for users. A SOC 2 report is therefore an attestation by a CPA firm, not a certification, and a Type 1 and Type 2 report say different things about timing. If a page says "SOC 2 certified," it uses a word that does not match the thing. If a report is not finished, do not describe it as done. Write what is true: for example, "our SOC 2 audit is in progress," plus the expected state, if you share one.
What "aligned" can honestly cover
"Aligned with" is the most flexible phrase, and so the easiest to stretch. Keep it honest by being able to answer three questions.
- Which version of the framework did you map to?
- Which of your controls cover which items?
- Where are the gaps, and what is the plan?
If you cannot answer, use plainer words: "we use the framework as a reference when designing controls."
Sentences you can write
- "We have completed X audit, issued on date, by an independent firm. Ask us for the report." (Only when true.)
- "Our X audit is in progress." (Only when true, and without implying an outcome.)
- "We map our controls to X. See our mapping." (When you have a mapping.)
- "We do not currently hold X." (Plain and often well received.)
A buyer who reads an honest "not yet" usually asks a follow-up. A buyer who finds an overclaim often stops.
Check your page
Search for the words certified, compliant, guaranteed, and fully secure. For each, write the evidence next to it. If the evidence is missing, edit the sentence. Do the same check on sales decks, since they travel further than the page.
Try it yourself
Click through it at your own pace, or open it full screen.
See how controls map to a framework. That mapping is what "aligned with" should rest on.
Where Safeguard fits
Safeguard's compliance and evidence automation helps teams map controls to frameworks and keep evidence organized. It does not make a company certified or attested. Those outcomes come from independent bodies. Try a free scan at gold.safeguard.sh/scan.
Quick check
Can a company be "SOC 2 certified"?
The AICPA frames SOC as assurance reports from CPAs, so "attested" or "has a SOC 2 report" is the accurate wording, and only when the report exists.
Is it safe to say we follow a framework?
Yes, if you can show your mapping and gaps. Say "aligned with" or "use as a reference," not "compliant," unless an assessment supports it.
Sources
Last reviewed: 19 October 2026.
