Sekorti
How to share a SOC 2 report under NDA, without a sales call.
Buyers ask for your SOC 2 report early, and it usually cannot just be emailed around. Here is why, what your options are, and how to make sharing it fast and controlled.
Why SOC 2 reports are shared under NDA
A SOC 2 report describes your controls in detail and, for a Type II report, how they performed over a period. Under AICPA guidance it is a restricted-use report, intended for your organisation, your customers and prospective customers who understand the system. That is why most companies require a non-disclosure agreement before sharing it.
A SOC 3 report, by contrast, is a short general-use summary you can publish openly. Many companies show the SOC 3 or a SOC 2 summary publicly and gate the full SOC 2.
Your options
| Method | Speed | Control | Problem |
|---|---|---|---|
| Email the PDF after a signed NDA | Slow | None after sending | Copies circulate; no record of who has it |
| Virtual data room | Medium | Good | Set up per deal; overkill for most requests |
| Trust center with gated access | Fast | Good | Needs an NDA step and access logging |
| Trust center with click-through NDA and Trust Rooms | Fastest | Best | Requires a tool that supports it |
A good SOC 2 sharing workflow
- Buyer requests access from your trust center instead of emailing sales.
- NDA is signed electronically as part of the request.
- You approve (or approve automatically for known domains).
- The report is delivered in a secure space, ideally watermarked, with every view logged.
- Access expires when it is no longer needed.
Bridge letters and report periods
A Type II report covers a fixed period. If a buyer asks after the period ended, a bridge letter (also called a gap letter) from management covers the time between the end of the report period and today, until your next report is issued. Keep it next to the report on your trust center.
How Sekorti handles it
On a Sekorti Trust Center, restricted documents such as a SOC 2 Type II report stay gated. Buyers request access from the page, you approve, and Sekorti handles the delivery. Trust Rooms give each buyer or auditor a secure workspace to share sensitive documents, collect e-signatures, manage NDA workflows and track every access.
Frequently asked questions
Can I put my SOC 2 report on a public website?
Generally no. A SOC 2 report is a restricted-use report. Publish a SOC 3 report or a summary instead and gate the full SOC 2.
Do I need an NDA to share a SOC 2 report?
Most companies require one, because the report is restricted-use and contains detailed control information. Your auditor’s report language and your own policy decide the exact terms.
What is a bridge letter?
A letter from management covering the period between the end of your last SOC 2 report period and today, until the next report is issued.
Create your free Trust Center.
Free forever, no card required. Live in minutes.