Question 1

What is a trust page for?

Accepted Answer

It answers the security questions before anyone has to ask. A trust page collects what a reviewer wants first: which frameworks you hold, what the report covers, subprocessors, where data lives, how to request documents. Done well, it removes a week of email from every deal. Done badly, it is a logo wall. Here is the test. Can a reviewer get from that page to something they can check? Or does every link end at a contact form? Ask what your page lets someone verify without talking to you.

Question 2

A customer sent a security questionnaire. What now?

Accepted Answer

Answer it once properly and keep the answers. The first one costs days. The tenth costs an hour, if you kept a maintained set of answers with owners and dates against them. Standard formats exist, and a reviewer will accept a completed one plus your report over a bespoke spreadsheet. Two rules make the difference. Never answer yes to something you have not built, because that answer becomes a contractual statement. And where the honest answer is no, say no and say what you do instead. Reviewers see hedged questionnaires every day and read them accurately.

Question 3

Am I responsible for my subprocessors' controls?

Accepted Answer

You are responsible for choosing them and for checking them. You do not attest to their internals. What the report covers is vendor management. How a subprocessor gets assessed before onboarding. What is reviewed afterwards. What happens when one has an incident. Collect their reports and read them, because a reviewer will ask whether anyone did. Watch for carve-outs. A subprocessor report excluding the service you depend on gives you nothing. That exclusion is stated in the report rather than hidden.

Question 4

Who is allowed to see my SOC 2 report?

Accepted Answer

Specified parties who know enough to read it. A SOC 2 report is a restricted-use document. That is why it goes out under an agreement rather than as a download. The constraint is the point, not a nuisance. Your report holds your system description, your control detail and any findings. It assumes a reader who understands the service. This is why a trust page routes to a request instead of publishing the file. If you have ever found your own report on a public link, chase that today.

Question 5

What is a complementary user entity control?

Accepted Answer

Something your customer has to do for your control to work. Your report names these, and your customers are supposed to read them. A common example is that you enforce access rules while they manage who gets an account. Your control only holds if theirs does. Two things follow. When you receive a vendor's report, read their complementary controls and check you are actually doing them, because that is the gap auditors find. And when you write your own, be specific, since a vague one shifts responsibility without telling anybody what to do.

Question 6

A customer rejected my SOC 2 report. What now?

Accepted Answer

Find out which part failed. It is seldom the whole report. Reviewers reject on specific things. Scope excluding the service they buy. A window that closed too long ago. A qualified opinion. A report reading as boilerplate. Ask them directly which it was. A rejected report is expensive in a way that is easy to underestimate. You carry the cost, the time, and now a conversation about your credibility. If the answer is that it looked templated, that is a finding about your auditor rather than your controls.

Question 7

Can I put a SOC 2 logo on my website?

Accepted Answer

There are AICPA logos for this, and they come with rules. The AICPA offers SOC logos so service organizations can show they received a report issued by a licensed independent CPA. Separate logos exist that only CPA firms may display, after registering. Use the one meant for you and follow its guidelines. The commoner mistake is not the logo at all. It is the words beside it. Writing that you are certified. Implying continuous coverage when your report describes a window that has closed.

Question 8

How do I read someone else's SOC 2 report?

Accepted Answer

Start at the opinion, then the scope, then the exceptions. In that order, and it takes fifteen minutes rather than an afternoon. The opinion tells you whether the auditor had a reservation. The system description tells you what was actually covered, and whether the service you depend on is inside it. The testing section tells you what was found. Then check the period covered and how stale it is, the complementary controls you are expected to operate, and who signed it. A report you filed without opening is a control you have not performed.

Question 9

An enterprise customer asked for evidence our AI feature is safe. What do we actually send?

Accepted Answer

Send what you can show. Name what you cannot. Safe is not a claim anyone can evidence, and asserting it invites the question you least want. Here is what a reviewer can actually be given. Which data the feature reaches, and under whose authority. What the agent is denied at the boundary. How an action ties back to a person. What gets logged, and for how long. What happens when the model provider changes something. Answer those five, state your limits, and it reads as competent. A longer document claiming safety reads as one written before anybody asked hard questions.

Question 10

My agent made a mistake that affected a customer. What do I tell them?

Accepted Answer

What it did, what you know, and what you changed. In that order, quickly. Your instinct is to wait until you understand everything, and that instinct costs you the credibility you are protecting. Say what your agent did and to what. Say what you have established, and what you are still checking, marked as still checking. Say what stops a repeat. Be honest if that is a constraint you have just added rather than one you had. A customer can work with an incomplete account that is accurate. They cannot work with a complete one that proves wrong.

Question 11

Do I have to tell users an AI is involved?

Accepted Answer

That is a legal question in a moving area, and it needs your counsel rather than a blog post. The commercial half is worth saying here. Enterprise questionnaires ask. Contracts name it more each year. A customer who finds out later treats it as concealment rather than omission. So the practical position is to know which of your features involve a model, and which involve a third-party provider. Be able to answer both without starting a research project. If you cannot produce that list today, disclosure is not your first problem.

Question 12

Is my agent a subprocessor?

Accepted Answer

Your agent is not. The model provider behind it probably is, and your counsel decides that. The operational half is not a legal question and you can settle it today. Your customer wants to know who else touches their data. If a third-party provider processes customer content, they belong on the list you publish. Finding out from a questionnaire that you never listed them is worse than the listing. So check your current subprocessor page against what your agents actually call. That gap is common, and entirely fixable before anybody asks.