Your trust page can say what controls you operate today and that an audit is in progress, with the type of audit and the expected timing if you control it. It must not imply a report or certificate you do not hold. SOC 2 results in reports, not certificates, and an in-progress audit is not a result.
Know the difference between the two outcomes
SOC 2 is an attestation. A licensed CPA firm issues a report with an opinion, according to the AICPA's description of SOC services. ISO 27001 is a standard against which an accredited certification body can certify you. Different outcomes need different words. Do not write "SOC 2 certified" or "ISO 27001 compliant" unless the facts support exactly that, and read your own contract promises before you publish.
Wording that is safe and useful
| Situation | Sample wording |
|---|---|
| Starting an audit | "We have engaged an independent auditor and are preparing for a SOC 2 examination." |
| Audit under way | "A SOC 2 Type 1 examination is in progress. We expect to complete it in the period we agreed with our auditor." |
| ISO preparation | "We operate an information security management system aligned with ISO 27001 and are preparing for certification." |
| Controls today | "We require MFA for all staff on our identity provider and review pull requests before production changes." |
| Questions | "Contact security at our domain for our security questionnaire answers." |
Only use a date you control, and update the page if it slips. Use controls statements that you can show evidence for.
Words to avoid
- "Compliant", "certified" or "ready" without a qualifier that matches the facts.
- "Fully", "always", "never" unless you can prove it.
- Logos or badges of standards bodies you are not entitled to display.
- Claims about a report that has not been issued.
For a fuller treatment of customer questions, see answering security questionnaires before your SOC 2 Type 1 arrives.
Sharing the report once you have it
A SOC 2 report is typically shared under NDA, and not everyone should have it. See sharing a SOC 2 report under NDA or on a trust page. The Journal of Accountancy article advises management to review the finished report to confirm it fits the system. Do that before you publish a summary.
Keep the page honest over time
- Give one person ownership of the page.
- Review it with each audit milestone and each major system change.
- Keep a log of what was said and when, so you can show accuracy later.
- Ask legal or your counsel to check wording that touches contracts.
Quick check
Can we put "SOC 2 in progress" on our website?
Yes, if it is true, for example if you have engaged an auditor. Be specific about the type and avoid implying a result.
Is ISO 27001 aligned the same as certified?
No. Alignment means you follow the standard's approach. Certification is a decision by an accredited certification body after an audit. Do not blur them.
Safeguard's compliance and evidence automation can help you keep the evidence behind each statement on your page. It does not grant any certification or report.
Sources
- AICPA and CIMA, SOC suite of services
- Journal of Accountancy, promises of fast and easy threaten SOC credibility
- ISO 27001 clause 4, context of the organization
Last reviewed: 19 October 2026.
