With a SOC 2 Type 1 you can promise that an independent auditor examined the design of your controls as of a stated date. You cannot promise they have operated effectively over time, that you are certified, or that data is safe. Say what the report covers, name the date, and commit to a Type 2.
What does a Type 1 actually say?
A Type 1 report describes the design of controls at a point in time and contains no opinion on operating effectiveness. A Type 2 covers a period and includes tests of operating effectiveness. The report contains management's description of your system, the auditor's opinion on whether the description is fairly presented and the controls were suitably designed, and the criteria categories in scope.
The words that matter are "at a point in time," "design," and the categories. A Type 1 for Security does not speak to Availability or Confidentiality unless they were in scope.
What can you safely write in a contract or questionnaire?
Use sentences that match the report one to one.
- "We have a SOC 2 Type 1 report, issued by an independent auditor, covering the Security category as of a given date."
- "The report is available under NDA on request."
- "We are working toward a Type 2 report covering a period starting on a given date," only if you have actually agreed the period with an auditor.
If your buyer asks for a commitment, offer process commitments you control: maintain controls described in the report, notify of material changes and provide an updated report when issued.
What should you avoid?
- "SOC 2 certified" or "SOC 2 compliant." The report is an attestation, not a certificate, and no body grants one.
- "Our controls are tested and effective." That is Type 2 language.
- "Audited annually" before a second report exists.
- Warranties that the report guarantees security or prevents breaches.
- Dropping the date or the category list.
- Passing the report to people who did not sign an NDA, if your agreement says to restrict it.
What do contracts ask for, and what do you do?
Right to a current report. Agree to provide the latest available report on request, and say how often you issue one. Do not promise annual delivery until you have a schedule.
Audit rights. Buyers sometimes ask to audit you. Offer the report and a questionnaire first, and limit onsite rights to what you can support.
Security schedule. Describe controls you actually run. If your contract schedule lists controls the report does not cover, those are new promises you must keep.
Breach notice terms. Align with the incident process written in your description, and coordinate with counsel on timing.
Subprocessors. Make sure your list in the contract matches your vendor register.
How do you bridge to Type 2?
Say that the Type 1 is the first step and that the Type 2 period begins on a date you can name. When it ends, send the new report. In the meantime, be ready for security questionnaires and for a buyer's request to see evidence of operation, such as an access review record, with a short written summary. Your counsel decides what to share under what terms.
Mistakes to avoid
- Marketing copy that outruns the report.
- Contract schedules copied from a buyer's template without checking what you actually do.
- Forgetting that the system description is part of the report and can be read as a statement about your practices.
- Not telling sales what the report does and does not say.
What to do
- Read your report's opinion, scope, categories and date, then write a one page summary for sales and legal.
- Draft approved sentences for the website, questionnaires and contracts.
- Remove or fix any claim that says certified, tested or effective.
- Compare contract schedules with the controls in your description.
- Set the Type 2 period date with your auditor before you promise one.
- Review all customer facing claims whenever a new report arrives.
Quick check
Can we say we are SOC 2 compliant?
Safer wording is that you have a SOC 2 Type 1 report from an independent auditor with its date and categories. Compliance and certification wording suggests more than the report says.
Will buyers accept a Type 1?
Some will, especially early on, and some ask for a Type 2. Ask your key buyers and offer a dated plan.
How Safeguard helps automate this
Safeguard's compliance suite covers frameworks, controls, evidence, continuous monitoring, automated tests and questionnaires, which helps with the contract side: security questionnaires can be answered from the same evidence collected from connected systems and code, so the answers stay consistent with what you actually run. Monitoring between audits supports the move toward a Type 2 period. Technical evidence comes from your real dependencies, scans and SBOMs. Safeguard helps you prepare and keep evidence ready. It does not provide legal advice, issue reports or replace the independent auditor. Book a call.
Sources
- AICPA, Trust Services Criteria (2017, with 2022 points of focus), introductory text describing Type 1 and Type 2 reports, paraphrased. Contract wording here is general information, not legal advice.
Last reviewed: 18 October 2026.
