Can sales send our SOC 2 report to a prospect?

Often, yes. But use your company’s approved sharing process. A SOC 2 report is for specified readers who have enough context to understand it. It is not a public marketing brochure.

A prospect can be an appropriate reader. Check the report’s intended-use language and any sharing terms before sending it. If the wording is unclear, ask your report owner or auditor.

Give sales a simple release process

• Confirm the request. Who needs the report and which service are they evaluating?
• Use the approved copy. Send the final report for the right service and period. Do not forward an old attachment just because it is handy.
• Check confidentiality terms. Follow your company’s NDA and document-sharing requirements.
• Limit access. Use the approved portal or delivery method. Avoid a public download link.
• Keep a record. Note who received which report and when.

Does an NDA settle everything?

No. An NDA addresses confidentiality. It does not change the report’s scope or who can appropriately use it. Nor does it turn an old report into evidence about a new product.

For example, a prospect buying your new analytics service may ask for a SOC 2 report. If the report covers only your payroll service, explain that difference. Sending the document without that explanation could give the wrong impression.

What if the report belongs to a supplier?

Check that supplier’s sharing terms. Do not assume your permission to download its report includes permission to pass it on. AWS, for example, tells customers to check the terms of the specific report before sharing it.

What can we put on the website?

A SOC 3 report is designed for general use and can be freely distributed. It contains less detail. See our SOC 3 explanation before deciding whether that format fits your needs.

A simple website statement can also explain which service has a SOC 2 report and how an eligible reader can request it. Keep the claim aligned with the actual report.

Sources

Schellman explains SOC 2 audiences and SOC 3 distribution. AICPA explains general-use SOC 3 reports. AWS explains sharing its compliance reports.