Which certifications does your AI vendor say it holds?

Why SOC 2 is two rows.

A Type II report covers a period of operating effectiveness. A Type I is a single date. A page saying only “SOC 2” hasn’t told you which.

Adding the two rows together would publish a Type II claim for vendors that never made one. And the sum is wrong twice over: 149 against 106 distinct vendors, because 43 of them name both.

Find your vendor.

Search a vendor to see what its pages name, or a standard like “42001” to see who names it.

67 of the 186 vendors whose pages we read name no certification we could find. That’s a fact about their pages, not their security. Several keep attestations behind a trust portal that asks for an NDA, and a portal we can’t read is recorded as unreadable, not as an absence.

Laws aren’t certifications, so they’re not counted here: GDPR is named by 89, and HIPAA is named by 61 vendors as a law their pages say they follow.

Common questions.

• Which AI vendors are SOC 2 certified?›

  The vendors naming SOC 2 on their trust pages are on this page, split by whether they said Type II or left the type unstated. Naming it isn't the same as holding a current report. Only the report tells you the period and the scope.

• What is the difference between SOC 2 Type I and Type II?›

  A Type I report says controls were designed appropriately on one date. A Type II says they operated effectively over a period, usually three to twelve months. A page that says only “SOC 2” hasn't told you which.

• What is ISO 42001?›

  The AI management system standard, published in 2023. It's the newest standard on this page. A vendor adding it is making a claim specifically about how it manages AI.

• Does a certification on a trust page mean the vendor is certified?›

  It means the vendor says so. Xither hasn't seen a report, confirmed an auditor, or checked an expiry date. Ask for the report, its period and its scope before relying on any count, including this one.

• Why do some AI vendors show no certifications here?›

  Because nothing on the pages we read names one. Several publish their attestations behind a trust portal that asks for an NDA first. A portal we can't read is recorded as a page we couldn't read, not as an absence.