Win deals with your report
What to do with your SOC 2 report once you have it
Put the report in front of the buyers who are waiting for it, answer their security questions faster, and keep the report current until your next audit. The audit is finished, but the report only pays for itself when it helps close deals.
Answer questionnaires and contracts faster
A report rarely ends the security review. Many buyers still send their own questionnaire, and their contract usually carries security clauses you have to agree to. Both slow a deal down when the answers live in one person's head.
In SimpleAudit you upload the questionnaire as a CSV, XLSX, DOCX or PDF file. Answers come from your records first and then your policies, and each answer is labeled with where it came from. Anything without a good answer is marked "Needs you", so you spend your time on the questions that actually need a person. Answers you approve go into an answer library and are reused the next time a buyer asks the same thing.
Contract review works the same way. Upload the contract and SimpleAudit reads its security clauses and marks each one Covered, Partly covered or Not covered, so you can see what to negotiate before you sign.
Cover the gap with a bridge letter
Your report covers a period that has already ended, so a careful buyer will ask what has happened since. A bridge letter answers that. It is a short statement that covers the time between the end of your audit period and today.
Your management signs the letter, not your auditor, so it carries no auditor assurance. It typically covers no more than 3 months, which is a convention and not an AICPA rule, as Linford & Co's guide to bridge letters explains. Our glossary entry on bridge letters covers what it says.
How long your report stays current
A SOC 2 report has no formal expiry date. Buyers do expect it to be no more than 12 months old, counted from the end of the audit period, and older reports draw more questions. Schneider Downs' guide to how long SOC reports stay valid goes through the detail.
That makes the date on your report worth showing early. Your SimpleAudit trust page shows "Report issued" and the date, so a buyer can see it before they ask.
The AICPA logo has its own rule
The AICPA SOC logo is tempting to put on your website, but it comes with terms of its own. In short, AICPA's SOC logo guidelines limit its use to twelve months after your report date, and the right to use it stops if no new report is issued. That is our summary, not AICPA's wording, so read their terms before you use the logo.
Keep your subprocessor list public
Buyers also want to know which other companies touch their data. Your trust page lists your subprocessors from the vendor list you already keep in SimpleAudit, so you maintain one list and buyers can check it without asking.
When your next audit starts
Your report covers one audit period, and buyers will expect a new one. When the next audit starts, you need the audit tools again: preparing for the audit and then running it.
The plan for this stage
Sell
Win deals with your report
$49.99 /mo
Or $41.66/mo billed annually.
Once your SOC 2 report is issued
Up to 5 seats
- Trust center shows control status, refreshed every hour
- Gated documents and per-deal share links
- AI answers 3 security questionnaires a month
- AI reviews security clauses in 3 contracts monthly
- Nothing is lost: policies and evidence stay, read-only
Step back up to Prove when your next audit starts.
Frequently asked questions
What should I do first with my SOC 2 report?
Share it with the buyers who are waiting for it, and keep track of who received it. It is not a public document, so Linford & Co's guide to sharing SOC reports is a good place to check who should get a copy.
Does a SOC 2 report expire?
No, it has no formal expiry date. Buyers do expect it to be no more than 12 months old, counted from the end of the audit period, and older reports draw more questions, according to Schneider Downs' guide to how long SOC reports stay valid.
What is a bridge letter and who signs it?
A bridge letter covers the time between the end of your audit period and today. Your management signs it, not your auditor. It typically covers no more than 3 months, which is a convention and not an AICPA rule, according to Linford & Co's guide to bridge letters.
Can I post my SOC 2 report on my website?
No. A SOC 2 report is meant for a limited group of readers. A SOC 3 report is the version made for the public, as Linford & Co's guide to sharing SOC reports explains.
Can I use the AICPA SOC logo?
Only within AICPA's terms. In short, AICPA's SOC logo guidelines limit its use to twelve months after your report date, and the right to use it stops if no new report is issued. Read their terms before you use it.
Who can buy the Sell plan?
A company can buy the Sell plan once a SOC 2 report has been issued. It is for companies that have the report and now need to get it in front of buyers.