By Mehdi HassanHow do you put a SOC 2 badge on your website correctly?
You put a SOC 2 badge on your website correctly by pairing it with exact wording: which report type you have, which period it covers and how to request it. A badge on its own is a decoration. A badge with precise wording and a link to your trust center is evidence a security reviewer can act on.
Getting this wrong is common and it costs credibility with the people who notice most. Security and procurement reviewers know the difference between Type I and Type II, and between an attestation and a certification. Sloppy wording tells them your compliance claims may be sloppy too. For where this fits in the wider site, see our guide to cybersecurity website design.
What's the difference between SOC 2 Type I and Type II wording?
SOC 2 Type I wording should say your controls were assessed for design at a specific date, and Type II wording should say they were tested for operating effectiveness over a period. They're different reports with different weight, and buyers care which one you have.
Status | What it means | Wording to use | Wording to avoid |
|---|---|---|---|
SOC 2 Type I | Auditor assessed control design as of a date | SOC 2 Type I report available on request | SOC 2 certified; SOC 2 compliant |
SOC 2 Type II | Auditor tested controls operating over a period | SOC 2 Type II report covering [period], available on request | Fully SOC 2 certified |
Audit in progress | Observation period or fieldwork underway | SOC 2 Type II audit in progress, expected [quarter] | A badge with no qualifier |
Preparing | Controls being built, no auditor engaged yet | Working toward SOC 2; security practices described below | SOC 2 ready; SOC 2 aligned (without detail) |
ISO 27001 certified | Certification body issued a certificate | ISO/IEC 27001 certified by [certification body] | ISO approved; ISO certified (with the ISO logo) |
SOC 2 reports also cover chosen trust services criteria, such as security, availability and confidentiality. If your report covers only security, don't imply it covers privacy or processing integrity. Precision here is the whole point.
What are the AICPA SOC logo rules?
The AICPA, which owns the SOC framework, publishes guidelines and terms for using its SOC logos. In broad terms, the logo is meant for organizations that have received a SOC report from a licensed CPA firm, and its use comes with conditions about currency and presentation. Read the current guidelines on the AICPA & CIMA site before you place the logo, because terms can change.
- Use only the official artwork, not a redrawn badge from a template or a compliance vendor's marketing kit, unless the terms allow it.
- Don't alter it. Recolouring, cropping or adding words to the mark usually breaks the terms.
- Keep it current. If your report has lapsed, remove the logo until you have a new one.
- Don't use it for work in progress. The logo signals a completed report.
How do you display ISO 27001 on a website?
Display ISO 27001 on a website by naming the standard correctly, naming your certification body and using that body's certification mark under its rules. Don't use the ISO logo itself: ISO doesn't certify companies, and it doesn't permit its logo to be used to signal certification.
- Write the standard's full name the first time: ISO/IEC 27001.
- Name the certification body that issued your certificate.
- Use the certification body's mark, following its usage rules, and the accreditation body's mark only where those rules allow.
- State the scope if it doesn't cover the whole company, such as a specific product or location.
- Offer the certificate or link to the certification body's public register if it has one.
If you hold related standards, such as ISO/IEC 27701 for privacy information management or ISO/IEC 27017 for cloud security, list them separately with their own scope. Don't bundle them into a single "ISO certified" claim.
How should you phrase SOC 2 "in progress" on your website?
Phrase SOC 2 "in progress" in plain words with a realistic stage and an honest expected date, and never with a badge. A startup that's partway through an audit can still win security reviews if it's transparent about where it is.
Say what stage you're at
"SOC 2 Type II observation period underway" is specific and credible. "SOC 2 coming soon" is not.
Name the auditor if you can
Naming the CPA firm you've engaged signals the audit is real. Check with them first.
Give an expected quarter, not a date
Audits slip. A quarter is honest; update it if it moves.
Describe current controls
Encryption, access control, background checks and incident response, briefly, so buyers can assess you today.
Offer evidence now
A Type I report, a pen test summary or a completed security questionnaire, if you have them.
Why false or premature claims are risky
Beyond annoying reviewers, overstating compliance can create legal exposure. The FTC treats misleading claims about security and privacy practices as potentially deceptive, and contracts often include representations about your compliance status that rely on what you've published.
A badge that implies a completed audit when you're still preparing can turn into a contract dispute if a customer relies on it. Plain wording about your real stage protects you and still reads as competent.
Where should SOC 2 badges go on the site?
SOC 2 badges should go where buyers check them: the footer, the security or trust page, and near enterprise calls to action such as "Book a demo" or pricing for larger plans. Putting them in the hero is rarely worth the space unless compliance is your main selling point.
- Footer: a small, consistent compliance strip with exact labels and a link to the trust center.
- Trust center: the full detail, with report type, period and request button. See our guide to trust center design.
- Enterprise pricing or demo pages: a short line near the form, such as "SOC 2 Type II report available on request".
- Sales and procurement pages: if you have a page for security reviewers, lead with it there.
Our cybersecurity website examples show how established vendors place compliance cues, and trust pages every B2B website needs covers the surrounding pages.
Do other industries display compliance the same way?
Other industries follow the same principle: exact names, real scope and no implied certification. The specifics differ by regulation. Health products talk about HIPAA, which has no official certification at all; fintech products deal with licensing and disclosure language; crypto companies handle regional risk warnings.
For those cases, see fintech website compliance, crypto website compliance, edtech website compliance and HR software trust and compliance pages. Accessibility is its own compliance area, covered in website accessibility for startups.
