"Do you have a SOC 2 report?" How to answer honestly when you don't (yet)

It is usually one of the first rows in the spreadsheet: "Do you have a current SOC 2 Type II report? If yes, please attach it." If you are a small SaaS company, the honest answer is often no. That is normal, and it doesn't have to stop the deal. How you answer matters more than the answer itself.

What the question is really asking

A SOC 2 report is an independent auditor's report on a company's security controls. A Type I report looks at whether the controls are designed properly at one point in time. A Type II report also tests whether they worked over a period, typically three to twelve months.

The buyer asks because a report saves them work: an independent party has already checked your controls. Without one, they need other ways to get comfortable. Your job is to give them those.

Answer the question that was asked

If you don't have a report, say No. Then use the comments column to say what you do have. For example:

"No. We have not completed a SOC 2 audit. Our security program is documented in our information security policy (attached), and we are happy to walk your team through our controls on a call."

If you have started, say exactly how far you are, and only what is true: for example, an auditor engaged, the type of report, and when the audit period starts or ends. Don't give a completion date you can't stand behind. It may end up in the contract.

What not to say

• "We are SOC 2 compliant." Without a report from an auditor, this has no clear meaning, and many reviewers read it as an attempt to sound certified.
• "We use AWS (or Google Cloud, or Azure), which is SOC 2 certified." Your hosting provider's report covers their controls, not yours. You can mention it as context about the infrastructure, but don't present it as your answer.
• "Yes" with a plan to sort it out later. An overclaim found during the review, or after signing, does far more damage than an honest no.

What you can offer instead

Buyers have other ways to assess a vendor without a report. Offer what you genuinely have:

• Your written security policies.
• A completed questionnaire with specific, consistent answers (this one).
• A penetration test summary, if you have had one.
• A short architecture overview: where data is stored, how it is encrypted, who can access production.
• Your list of subprocessors, with links to their own security reports.
• A call with whoever runs security, even if that is the founder.

Specific, consistent answers are themselves evidence. A reviewer can tell the difference between a team that knows how its systems work and one that is filling in boxes.

When to start a SOC 2

If the same request keeps coming from the customers you most want, it is time to plan for one. It takes months and has real costs, so start before it blocks a deal rather than during one. Until then, honest answers and good documentation carry a lot of small-company deals.

How Rendro handles this question

Rendro never claims a certification your documents don't support. If your company profile says you don't have SOC 2, or your documents don't mention it, the draft says so or is flagged for you to answer. You stay in control of exactly what goes back to the buyer.