SOC 3 Audit
Under SSAE 18
A SOC 3 report is a general-use summary report based on your SOC 2 examination. You can publish it freely on your website to demonstrate your security compliance without exposing confidential technical details.
How is SOC 3 different from SOC 2?
SOC 3 is based on the same audit as your SOC 2, but it's designed to be shared freely — without exposing the technical detail of your controls.
| Criteria | SOC 2Full | SOC 3Public |
|---|---|---|
| Audit Basis | A full audit of the Trust Services Criteria (security, availability, integrity, confidentiality, privacy). | The same audit as the SOC 2 — not a separate or additional process. |
| Level of Detail | Includes the full system description, the tests performed, and detailed results for each control. | A high-level summary with the auditor's opinion, without the technical detail of the tests. |
| Audience | Clients and prospects, typically under a non-disclosure agreement (NDA). | The general public — no distribution restrictions. |
| Where Is It Used? | Security questionnaires, vendor reviews, procurement teams. | Website, "Trust & Security" page (Trust Center), sales materials. |
| Does It Replace the Other? | No — it remains the document that clients with stricter security requirements will ask for. | No — it's a public-facing complement, not a substitute for SOC 2. |
Which companies use a SOC 3 report?
Any organization with a current SOC 2 report that wants to demonstrate its compliance publicly, without exposing confidential details about its controls.
| Type of company | How SOC 3 helps | Where it is used | SOC 2 required first? |
|---|---|---|---|
| SaaS companies | Shortens the sales cycle by answering prospects' security questions up front. | Trust Center or "Security & Trust" page | Yes |
| Cloud / hosting providers | Shows enterprise customers that the infrastructure meets recognized standards. | Corporate website and master service agreements | Yes |
| FinTech companies and payment processors | Builds trust with end users and banking partners without publishing sensitive technical details. | App, website, and regulatory materials | Yes |
| Marketing and sales teams | Use the SOC 3 report as evidence of compliance in sales proposals and RFP responses. | Proposals, landing pages, and initial security questionnaires | Yes |
| Growth-stage startups | Answers baseline security questions from investors and early enterprise customers. | Investor data room and website | Yes |
Everything About the SOC 3 Report (SSAE 18)
The most common questions about the SOC 3 report, how it relates to SOC 2, and how to use it publicly. Select a question to see the answer.
What is a SOC 3 report?
A SOC 3 report is a general-use attestation report, issued under the same AICPA SSAE 18 framework as SOC 2, that summarizes the auditor's opinion on your organization's controls relevant to the Trust Services Criteria, without including the confidential technical details of control testing.
Unlike the full SOC 2 report, which is restricted-use, a SOC 3 report is designed so you can publish it freely on your website, without requiring readers to sign a nondisclosure agreement.
SSAE 18 · Trust Services CriteriaIs SOC 3 a certification?
No. Like the SOC 2 report it is derived from, SOC 3 is not a certification granted by a certifying body. It is an attestation report containing the opinion of an independent CPA auditor.
Important distinction: the correct phrasing is "obtaining a SOC 3 report" or "displaying a SOC 3 seal," not "getting SOC 3 certified."
What are the Trust Services Criteria in a SOC 3?
They are the same five categories evaluated in a SOC 2: Security (required), Availability, Processing Integrity, Confidentiality, and Privacy. The SOC 3 report summarizes the auditor's opinion on these same criteria in a format suitable for public distribution.
How is SOC 3 different from a generic security seal or badge?
Many website "security seals" are just marketing graphics with nothing behind them. SOC 3 is different: it is an actual report containing an independent CPA auditor's opinion, verifiable, with an issue date and a defined coverage period — not just an icon.
What is a SOC 3 report used for, and what are the benefits?
A SOC 3 report lets you:
- Publish your commitment to security on your website without exposing sensitive technical details
- Shorten the sales cycle by answering initial security questionnaires without signing an NDA
- Stand out from competitors that show no public evidence of compliance
- Strengthen your sales proposals and RFP responses with a verifiable document
What is the difference between SOC 2 and SOC 3?
| Criteria | SOC 2 (full report) | SOC 3 (general use) |
|---|---|---|
| Underlying audit | Full examination against the Trust Services Criteria | The same examination as the SOC 2 — not an additional process |
| Level of detail | Full system description and detailed results for each control | High-level summary with the auditor's opinion |
| Distribution | Restricted, under NDA | Public, with no restrictions |
In short, SOC 3 is the public-facing version of SOC 2, not a separate report.
Can I get a SOC 3 without first completing a SOC 2?
No. A SOC 3 report is issued from the same SOC 2 Type 2 examination. It is not a separate audit process, but a summarized, general-use version of the same work.
How is SOC 3 different from SOC 1?
SOC 3 is derived only from SOC 2 and summarizes the Trust Services Criteria (Security, Availability, and so on) for public distribution. SOC 1 evaluates controls relevant to your customers' financial reporting (ICFR) and, because it contains sensitive information, has no equivalent public version.
Does SOC 3 replace SOC 2?
No. SOC 3 is a public-facing complement, not a substitute. Customers with stricter security requirements will still request the full SOC 2 report under NDA.
Which companies use a SOC 3 report?
It is common among:
- SaaS companies looking to shorten their sales cycle
- Cloud / hosting providers that need to demonstrate compliance to enterprise customers
- FinTech companies and payment processors that want to build trust without exposing technical details
- Marketing and sales teams that use the report in proposals and RFP responses
- Growth-stage startups answering baseline questions from investors
In general, any company that already has a SOC 2 report and wants to demonstrate its compliance publicly.
How do I know if my company needs a SOC 3?
If you answer yes to any of these questions, you should consider one:
- Do you already have, or are you about to obtain, a SOC 2 report?
- Do you want to show your security compliance publicly on your website?
- Would you like to stop signing an NDA every time a prospect asks for basic security evidence?
Where is a SOC 3 report usually published?
Most commonly, it is posted on a Trust Center or "Security & Trust" page on your website and used as supporting evidence in sales proposals, RFP responses, and initial security questionnaires.
How much extra time does a SOC 3 take after a SOC 2?
Virtually none. Because it is issued from the same examination, the SOC 3 report is delivered together with the SOC 2 Type 2 report, with no additional examination period or fieldwork.
Important: if you haven't started your SOC 2 yet, you can't skip straight to SOC 3. The SOC 2 Type 2 examination is completed first, and the SOC 3 report is issued from that same work.
What exactly is included in a SOC 3 report?
It includes:
- The auditor's opinion on the Trust Services Criteria in scope
- A general description of the system, without sensitive technical details
- The period covered by the examination
It does not include the detailed control matrix or individual test results — those remain only in the full SOC 2 report.
Do I need to do anything extra to get my SOC 3?
No. If you are already completing your SOC 2 Type 2 with us, just request it and we include it as part of the same process. No additional evidence, controls, or testing is required.
Can a SOC 3 report include exceptions?
Yes. If the underlying SOC 2 had them, the public summary may reflect a qualified opinion. That is why many companies prefer to remediate significant deviations before publishing their SOC 3, although it is not mandatory.
How often should a SOC 3 report be renewed?
Like the SOC 2 it is derived from, it is renewed annually. When you renew your SOC 2 Type 2 each year, the SOC 3 is updated along with it.
Is SOC 3 recognized outside the United States?
Yes. Because it is based on the same AICPA SSAE 18 framework as SOC 2, it is recognized in the United States, Latin America, and other markets where service providers are asked for security assurance.
Do you offer SOC 3 reports in Latin America?
Yes. We work with technology companies in the United States, Colombia, Mexico, Chile, Peru, Argentina, Panama, Costa Rica, Ecuador, and other countries, in English and Spanish.
Has a customer asked for a SOC report?
Choose the option that best describes your situation, and we'll take you straight to what you need.