No. An attestation or report issued to your model provider covers that provider's own systems and controls, not your application. You can reference it as evidence about a subprocessor you rely on, but you still need to show the controls you operate yourself. Word it carefully so a reviewer does not read it as your own report.
What a provider's report covers
A SOC 2 report is an examination of controls at a service organization, relevant to security, availability, processing integrity, confidentiality, or privacy, as AICPA describes the SOC suite. The organization examined is the one named in the report. If your product calls a provider, the provider's report describes the provider's service, not the code, data handling, and access controls in your product.
What you can and cannot say
| Statement | Fair? |
|---|---|
| "Our model provider has published a SOC 2 report, available under their terms" | Fair if true and you have checked it |
| "We use a provider that holds audit reports" | Fair, but vague |
| "We are SOC 2 compliant because our provider is" | Not fair |
| "Customer prompts are processed by [provider] under a data processing agreement" | Fair if true |
| "Our application controls are covered by our provider's report" | Not fair |
How to handle it in a review
- List the provider as a subprocessor, with what data it receives. See what to publish in a subprocessor list.
- Review their report yourself when you can: scope, period, exceptions, and any complementary controls they expect customers to operate.
- Do the customer side. Reports often assume the customer manages access to its own account, key handling, and data choices. Those are yours.
- Answer with your own evidence for access control, change management, logging, and vulnerability handling.
- Be clear about your own status. If your audit is in progress, say it is in progress. Never imply a report you do not hold.
Map the shared parts
NIST's AI Risk Management Framework and its Generative AI Profile are voluntary references that help describe who manages which risk. Use them to structure the conversation, not to claim conformance.
A short note on Safeguard
Safeguard offers compliance and evidence automation to collect proof of the controls you operate, and vendor evidence to sit beside it. Try a free scan at gold.safeguard.sh/scan.
Try it yourself
Open the framework mapping demo and see how one control can answer several frameworks. Look at which controls stay yours no matter which provider you use.
Click through it at your own pace, or open it full screen.
Quick check
Can we attach our provider's report to our questionnaire?
Only if their terms allow sharing. Otherwise point the reviewer to the provider's own trust page.
Does using a certified provider reduce our own scope?
It can reduce what you must build, but you still describe and evidence the controls you run.
Sources
Last reviewed: 19 October 2026.
