What is SOC 3? Public trust reports and how they differ from SOC 2

Photo: Unsplash

SOC 3 is often described as the “marketing-friendly” sibling of SOC 2. It reports on controls relevant to Trust Services Criteria but is intended for general distribution—no NDA required.

Related: SOC 2 vs SOC 3 · Collection

---

Key takeaways

• SOC 3 is a summary-level attestation suitable for websites and trust centers.
• Detailed testing and control descriptions live in the SOC 2 report (restricted).
• Many vendors complete SOC 2 first, then add SOC 3 for public trust signaling.
• SOC 3 does not replace SOC 2 for enterprise due diligence.

---

What is SOC 3?

A SOC 3 report provides assurance that controls meet selected TSC categories, presented for public audiences (prospects, partners, general public).

---

SOC 3 vs SOC 2

	SOC 2	SOC 3
Distribution	Restricted (typically NDA)	General use
Detail level	Full control descriptions & tests	Summary
Buyer use	Deep security review	Trust marketing

---

When to pursue SOC 3

Consider SOC 3 when:

• You want a public trust badge or report link on your site
• Sales needs a shareable artifact without NDAs
• You already maintain SOC 2 controls and evidence

See how to use your SOC 2 badge.

---

Disclaimer (legal note)

Scope and criteria must align with your SOC 2 program. Informational only.