How listings work, and how to change yours

SOC2C is a directory of companies that publish SOC 2 and other compliance information. Listings are compiled from public sources — mainly the company's own trust center page — and link back to that source. We are an independent registry, not an auditor, a certification body, or a compliance platform.

From your own publicly accessible trust center or security page, read at a point in time. That includes the frameworks you list, document titles, published subprocessors, FAQs and updates. We do not receive data from Vanta, SafeBase, Drata or any other platform, and we have no private or partner access to them. Every listing attributes the source and links back to your official trust center.

No. We store the title of each document your trust center lists — for example “SOC 2 Type II Report” — and whether your page marks it public or gated. We do not hold, host, mirror or link the file itself, and we have no way to obtain a gated one. The only files on SOC2C are those a company uploaded itself after claiming its profile.

No. A default Listed profile means only that we recorded what your public page said. We do not hold, host or have access to your audit report, and we never claim to have read one unless your company uploaded it to us directly. See how verification works for exactly what each tier asserts.

The same reason a business appears in any directory: the underlying information was published publicly by the company itself. No authorization is claimed or implied, and every listing says on its face whether it is unverified. If you would rather not appear, we will remove the page — see the removal question below.

Tell us and we will correct or clear it. Subprocessor entries reflect what your trust center published when we read it; if you have since removed or changed that list, our copy is stale and we treat that as a defect on our side. Email support@soc2c.com and we will re-read your page or clear the section.

Two ways. Claim the profile with a work email on your company domain and edit it yourself, or email support@soc2c.com with the correction. Claiming is free and also gives you the verified badge and the ability to keep the page current.

Email support@soc2c.com from an address on the company's domain and ask for removal. No legal notice, form or account is needed. We act on removal requests within two business days; the page then returns 404 and drops out of search, the sitemap and every comparison. We do not require a reason.

That was a fault on our side: transactional email was misconfigured and verification codes were not being delivered. It is fixed. Retry the claim, and if a code still does not arrive within a few minutes, email support@soc2c.com and we will verify you manually. A missing code never means someone else claimed your profile — claiming requires an email on your own domain.

No. A claim requires a working email address on the company's own domain, and the code is sent to that address. There is no other route to control a listing.

Listed means public information, not verified by the company. Domain means someone with a work email on the domain claimed it. Report means our team reviewed an audit report the company sent us. Live means status is synced from a connected compliance platform. Every page states its own tier in plain words.

No. SOC2C is independent and has no partnership, data feed or agreement with any of them.

support@soc2c.com reaches a monitored inbox. We aim to reply within two business days, and sooner for removal and accuracy requests. If you have written to us and had no reply, write again to that address — an unanswered message means it did not reach us.