SOC 3 Report

What is a SOC 3 report?

A SOC 3 report is a short, public summary of a vendor's SOC 2 audit. In that audit, an independent CPA firm checks the vendor's controls (its security rules and whether it follows them) against criteria set by the AICPA, the US accounting body.

Microsoft describes SOC 3 as "a short, publicly facing version of the SOC 2 Type 2" report. It is a "general use" report, which means the vendor can share it freely, even post it on its website. A full SOC 2 report is a restricted use report meant for the vendor and its customers.

A vendor cannot get a SOC 3 on its own. It must first go through a SOC 2 examination, and the SOC 3 is built from it. It keeps the auditor's opinion and a shorter system description. It leaves out the controls the auditor tested and the detailed test results.

Why it matters to you

Some vendors post the SOC 3 openly and keep the SOC 2 behind a request. Microsoft, for example, offers its Azure SOC 3 publicly and its SOC 1 and SOC 2 reports through a separate portal. Others gate it too: Informatica's trust page says use of its SOC 3 "is restricted and requires an NDA". Either way, a SOC 3 is easy to get, so it is tempting to file it and move on.

It does not replace the SOC 2. You cannot see which controls were tested, so you cannot tell whether the ones that matter to you (access to your data, backups, deletion) were covered. You also cannot see the details behind any problem the auditor found.

Scope is the other gap. A report covers the systems named in it, not every feature the vendor ships later. Venpo found that Insightly's new AI connector is not covered by its SOC 2 report, and a SOC 3 built from that audit would not cover it either.

What to check

• The audit period dates. If the period ended many months ago, ask for a bridge letter.
• The services named in the system description. Make sure the product you actually buy is listed.
• Which of the five areas are covered: security, availability, processing integrity, confidentiality and privacy.
• Whether the auditor's opinion is "qualified", which means the auditor found a problem serious enough to change its conclusion.
• For vendors that hold your customers' data, ask for the full SOC 2 Type 2 report, usually under an NDA (a confidentiality agreement).

How Venpo helps

Venpo watches your vendors' public legal pages, including trust center pages, DPAs and subprocessor lists. When one changes, you get a plain-English email that says what changed and why it matters, so a report that drops a service or a new feature that sits outside the audit does not slip past you.