Print / Save PDF

Sharing your report

SOC 2 reports are commonly restricted to specified parties (customers often get them under NDA or via a trust center). AICPA describes SOC 3 reports as “general use reports” that “can be freely distributed.” [1]

SOC 3 addresses the same trust services criteria as SOC 2 but without the same level of detail. Type 1 vs Type 2 and the “specified period” wording are on the SOC 2 auditor FAQ. [2]

Trust-center agents in this dataset

11 listings tagged with the “trust-center” task, alphabetical by name. A tag is vendor-stated relevance, not a ranking or an endorsement. [5]

• Comp AI
• Conveyor
• Drata
• episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence)
• Rippling Automated Compliance
• SafeBase
• Secureframe
• Sprinto
• Vanta
• Whistic Automation Orchestrator (agentic assessments)
• Wolfia Questionnaire Agent (security questionnaires and trust center)

Related comparisons (not a ranking): security questionnaire agents · Conveyor vs SafeBase.

Handling security questionnaires

After a report exists, buyers still send questionnaires. Use the answer-kit template on the audit-prep templates page, and look into listed questionnaire agents if that is the work you want to do.

35 listings tagged “questionnaire-automation”, alphabetical by name. Not a ranking. [5]

• Akitra Andromeda AI compliance agents
• Athereon LAiKA (AI agent for ISMS, risk and questionnaires)
• Black Kite AI Agent
• Censinet Risk Assessor Agent (Assessor Agent for Supply Chain and Vendor Risk, Censinet GRC AI)
• Co-Brain Questionnaire Agent (security questionnaire automation)
• Complyance GRC AI Agents
• Conveyor
• Crest TPRM AI agents (Vendor Outreach, Questionnaire Intelligence, Continuous Monitoring, Risk-Based Scoring, Finance, Screening and Efficiency agents)
• Drata
• episki Autonomous GRC (AI Orchestration agents for policies, questionnaires, vendors and evidence)
• Flank (autonomous legal agents)
• FlowForma Assure (AI agents for vendor risk assessment)
• GetTeddy compliance agents (Certification, Gap Audit, Policy, Evidence, Questionnaire and Contract agents)
• Optivalue.ai questionnaire agents (security questionnaires, TISAX and third-party collection)
• osapiens Agent Factory (supplier and supply-chain compliance agents)
• ProcessUnity TPRM AI Agents (Evidence Evaluator, Assessment Autofill)
• Rescana autonomous TPRM agents (Discovery & Classification, Risk Assessment, Communication & Remediation and Manager agents)
• Rippling Automated Compliance
• RiskXchange The Agency (32 AI agents for third-party risk)
• SAFE TPRM AI Co-Worker
• SafeBase
• Scrut Automation
• Scytale
• Secureframe
• SecurityScorecard
• Sprinto
• trail Governance Agents (GRC and AI governance agents)
• TrustCloud TrustLens (agentic third-party risk assessments)
• Trustero AI (GRC agents)
• Vanta
• VibrantiX agentic compliance platform (Evidence Review, Vendor Risk Scoring, Risk Detection, Customer Trust, Policy Drafting and Control Remediation agents)
• VISO TRUST AI Agent (agentic third-party risk management)
• Whistic Automation Orchestrator (agentic assessments)
• Wolfia Questionnaire Agent (security questionnaires and trust center)
• Zania

Use-case table: security questionnaire agents.

Annual renewal

SOC 2 Type 2 covers suitability of design and operating effectiveness “throughout a specified period”. Plan the next period with your auditor. This page does not claim a required length. [2] See the SOC 2 auditor FAQ.

For ISO/IEC 27001 certification, European co-operation for Accreditation (citing ISO/IEC 17021-1 clause 9.1.3) states: “Surveillance audits shall be conducted once a calendar year except in years where recertification is conducted”; “in each calendar year, at least ... there shall be an audit, whether surveillance or recertification.” [4]

ISO does not certify. Certificates should cite the full reference (for example “certified to ISO/IEC 27001:2022”). [3]

Browse listed firms on the auditors directory (facts only, not endorsements).

FAQ

Can I freely share a SOC 2 report?

SOC 2 reports are commonly restricted to specified parties. Customers often receive them under NDA or through a trust center. AICPA describes SOC 3 reports as general-use reports that can be freely distributed.

What is the difference between SOC 2 and SOC 3 for sharing?

SOC 3 addresses the same trust services criteria as SOC 2 but without the same level of detail, so AICPA treats it as a general-use report. See the SOC 2 auditor FAQ for Type 1 vs Type 2.

How often is an ISO 27001 certificate looked at after issue?

European co-operation for Accreditation, citing ISO/IEC 17021-1 clause 9.1.3: surveillance audits shall be conducted once a calendar year except in years where recertification is conducted; in each calendar year there shall be an audit, whether surveillance or recertification. Certificates should cite the full reference, for example “certified to ISO/IEC 27001:2022”.

Is the trust-center list a ranking?

No. This is not a ranking or score. Agents appear because the dataset tags the “trust-center” or “questionnaire-automation” task. Order is alphabetical by name.

Related: which framework to look into · published costs · tools.

Sources

1. AICPA & CIMA — SOC 3 (general-use reports). https://www.aicpa-cima.com/topic/audit-assurance/audit-and-assurance-greater-than-soc-3
2. AICPA, 2017 Trust Services Criteria (March 2020 points of focus), archived official PDF. https://web.archive.org/web/20230905175109id_/https://us.aicpa.org/content/dam/aicpa/interestareas/frc/assuranceadvisoryservices/downloadabledocuments/trust-services-criteria-2020.pdf
3. ISO — ISO/IEC 27001 (Edition 3, 2022-10; Amd 1:2024). https://www.iso.org/standard/27001
4. European co-operation for Accreditation FAQ — ISO/IEC 17021-1 clause 9.1.3. https://european-accreditation.org/sp_accordion_faqs/question-37-12-iso-17021-12015-clause-9-1-3/
5. Agent Index dataset v0.1.27. https://theagentindex.io/agents.json

Prepared by Agent Index (Heritage Services). Last reviewed 21 Oct 2026. General information, not legal advice; confirm scope with your counsel or auditor. Checklist items are working aids, not a statement of what any auditor requires. Licensed CC BY 4.0.