Most companies share a SOC 2 report after a mutual NDA or a request form, because the report describes internal controls in detail. A public summary of scope and dates on your trust page, plus a fast request process for the full report, is the common middle path.
What the report is
SOC reports are issued by CPAs, and the AICPA sets the professional standards they follow. The AICPA names five trust services categories: Security, Availability, Processing Integrity, Confidentiality and Privacy. A report covers the categories in scope for that engagement, not all five by default. Check your own report for which ones it includes before you describe it.
Three ways to share
Open download. Fast and friction free. It also exposes control descriptions to anyone, including attackers doing reconnaissance and competitors. Few companies choose this for the full report.
Request form with click through terms. The reviewer enters work details, accepts terms and gets a link. It is quick, creates a record of who has the report and works for most buyers.
Individual NDA. Slowest, but some buyers and some auditors' terms call for it. Keep a standard mutual NDA ready so signature takes a day, not a week.
What to publish regardless
Publish facts that are safe and useful:
- The type of report, Type 1 or Type 2, as it appears on the report.
- The period or point in time it covers.
- The categories in scope.
- The auditor's name, if the engagement terms allow it.
- How to request the full report, and an expected response time.
Do not say "SOC 2 certified". SOC 2 yields a report from an independent auditor, not a certificate. See the related post on answering questionnaires before a Type 1 arrives.
Read your auditor's terms
Some engagement letters restrict distribution. Check them before you set up an open or semi open flow. Also check whether bridge letters are available for the gap since the period ended, because buyers often ask.
Keep a distribution log
Whoever you share with, log the recipient, date and version. When a new report arrives, you can refresh the people who matter.
Sources
Quick check
Should we share the report before the NDA is signed?
Not the full report. Share the public summary and offer the report once terms are accepted.
What if the report has exceptions?
Be ready to explain them. Reviewers read the exceptions section first, so prepare a plain description of each and what changed since.
Last reviewed: 19 October 2026.
