Bridge Letter

A bridge letter is a short letter from a vendor's management covering the gap between the end of its last SOC report period and today. It says no material control changes are known, but no auditor has checked it.

What is a bridge letter?

A SOC 2 report covers a fixed period that has already ended. A bridge letter, also called a gap letter, covers the months between the end of that period and today.

The vendor's management writes and signs it, not the auditor. According to EY, it is management's representation, not the CPA firm's, and a bridge letter normally covers about three months.

A typical bridge letter includes:

The dates of the last report period.
A list of changes to its controls since then, or a statement that management knows of none.
A statement that management knows of no material issues or deficiencies that could change the auditor's opinion.
Management's signature and a date.

Vendors often post them next to the report. Atlassian's SOC 2 page, for example, lists bridge letters among its downloads.

Why it matters to you

Your review of a vendor often happens months after its report period ended. Without a bridge letter you have no statement at all about those months.

But the letter is the vendor speaking about itself. It carries far less weight than tested controls. If the vendor changed hosting, added an AI subprocessor or found a control problem, the letter is where that should show up, and it may not.

Your own auditors and customers may ask about the gap. A bridge letter on file shows you asked.

What to check

The letter names the right report period and the product you use.
The gap it covers is short. If it runs much longer than three months, ask when the next report is due.
It discloses changes and issues, or says plainly that there were none.
It is signed by the vendor's management and dated.
Compare it with the vendor's subprocessor list and security addendum, which may show changes the letter does not.

How Venpo helps

Venpo monitors your vendors' trust center pages, security addenda and subprocessor lists. If one of them changes during the gap a bridge letter covers, you get a plain-English email, so you can ask the vendor about it.

Start for free

Frequently asked questions

Is a bridge letter the same as a SOC 2 report?

No. A SOC 2 report is the auditor's opinion on tested controls, while a bridge letter is the vendor's own unaudited statement about the months since.

How long can a bridge letter cover?

There is no official limit, but common practice is about three months. A longer gap usually means you should ask for the next report instead.

Related terms

Security and Compliance SOC 2 Report A SOC 2 report is the document a CPA firm issues after examining a vendor's controls. It holds the auditor's opinion, management's statement, a description of the system and, in a Type 2 report, the tests the auditor ran and what they found. Security and Compliance SOC 2 SOC 2 is an independent audit report on a vendor's security controls, written by a CPA firm under AICPA standards. It shows what an auditor tested and found for specific systems over a specific period, not a blanket promise that your data is safe. Vendor Documents Trust Center A trust center is a vendor's page or portal for security, privacy and compliance information, such as SOC 2 reports, certificates, subprocessor lists and security policies. Some documents are public, and others need sign-up or an NDA. Vendor Management Annual Vendor Review An annual vendor review is a yearly check of your important vendors to confirm they are still needed, still correctly rated for risk and still meet your requirements, using their latest security reports and legal documents. Vendor Management Continuous Vendor Monitoring Continuous vendor monitoring means watching your vendors between formal reviews, so you learn about changed terms, new subprocessors, security problems or business trouble when they happen instead of at the next annual review.

Sources

Last reviewed October 30, 2026